Symantec ICD Schema

Dictionary

The Dictionary defines schema attributes and includes references to the events and objects in which they are included.

Name	Attribute	Type	Referenced By	Description
AMSI Risk	risk_ref_value	Integer	AMSI Activity Event	The Anti-malware Scan Interface (AMSI) risk level.
API	api	API	API Activity Event	The API Activity attributes.
Access Complexity	access_complexity_id	Integer	Common Vulnerability Scoring System V2 Object	The access complexity Common Vulnerability Scoring System (CVSS) metric.
Access Mask	access_mask	Integer	Directory Activity Event File Activity Event File Detection Event Registry Key Activity Event Registry Key Detection Event	The access mask in platform-native format.
Access Mask Values	access_mask_ids	Integer Array	Directory Activity Event File Activity Event File Detection Event Registry Key Activity Event Registry Key Detection Event	The access mask values.
Access Scope	access_scope_id	Integer	Process Activity Event	The scope of the requested access.
Accessed	accessed	Datetime	File Object Module Object	The time that the file was last accessed. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Accessor	accessor	String	File Object Module Object	The name of the user who last accessed the object.
Account Disabled	account_disabled	Boolean	User Object	The indication of whether the user's account is disabled.
Actor	actor	Process	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Activity Event Process Detection Event Process History Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event User Session Activity Event User Session Detection Event	The process that performed the operation or action on the target object. For example, the process that could have created a new file or violated a policy.
Actual Permissions	actual_permissions	Integer Array	Memory Activity Event Process Activity Event Process Detection Event	The permissions that were granted to the process.
Address	address	String	Peripheral Device Object	The peripheral device address.
Admin Session	is_admin	Boolean	User Object User Session Object	The indication of whether the user or user session is admin/root.
Advertised	is_advertised	Boolean	Transport Layer Security Object	The indication of whether the protocol is advertised by the server.
Alert	is_alertable	Boolean	Rule Object	Indicates whether the event should be considered for management server alerting.
Algorithm	algorithm	String	Fingerprint Object	The algorithm that was used to create the fingerprint. The valid values are one of the following: "md5", "sha1", or "sha2".
Allocated Memory	mem_allocated	Long	Memory Usage Event	The Java Virtual Machine® (JVM) allocated memory (in bytes).
Analysis	analysis	String	AMSI Activity Event API Activity Event Administrative Group Query Event Boot Record Detection Event DNS Query Event Directory Activity Event Directory History Event Directory Query Event File Activity Event File Detection Event File History Event File Query Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Job Query Event Kernel Activity Event Kernel Detection Event Kernel Object Query Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Module Query Event Monitored Source Event Network Information Query Event Network Query Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Peripheral Device Query Event Prefetch Query Event Process Activity Event Process Detection Event Process History Event Process Query Event Registry Key Activity Event Registry Key Detection Event Registry Key Query Event Registry Value Activity Event Registry Value Detection Event Registry Value Query Event Service Query Event Startup Application Configuration Change Event Startup Application Query Event User Query Event User Session Activity Event User Session Detection Event User Session Query Event	The anti-malware emulation analysis.
Application ID	app_uid	String	File Content Detection Event Policy Override Audit Event Process Object	The unique identifier of the application that is associated with the event or object.
Application Name	app_name	String	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Policy Override Audit Event Print/FAX Content Detection Event Process Object	The name of the application that is associated with the event or object.
Application Version	app_ver	String	Policy Override Audit Event Process Object	The version of the application that is associated with the event or object.
Assignee	assignee	String	Incident Creation Event Incident Update Event	The name of the user who is assigned to the incident.
Attack Vector	attack_vector_id	Integer	Common Vulnerability Scoring System V2 Object	The attack vector Common Vulnerability Scoring System (CVSS) metric.
Attacker IP	attacker_ip	IP Address	Host Network Detection Event Host Network Traffic Detection Event	The IP address of the malicious network device. The format is either IPv4 or IPv6.
Attacks	attacks	Attack Array	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Activity Event Process Detection Event Process History Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event User Session Activity Event User Session Detection Event	The array of attacks that are associated with the event.
Attempt	attempt	Integer	Email Delivery Event	The delivery attempt.
Attribute IDs	attribute_ids	Integer Array	File Object Module Object	The array of file attributes.
Attributes	attributes	Integer	File Object Module Object	The bitmask value that represents the file attributes.
Audit	audit	Boolean	Boot Record Detection Event Compliance Event Compliance Scan Event Email Analytics Event Email Detection Event Email File Detection Event Email URL Detection Event File Detection Event File Response Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Network Detection Event Peripheral Device Detection Event Process Detection Event Process Response Event Registry Key Detection Event Registry Key Response Event Registry Value Detection Event Registry Value Response Event Startup App Response Event User Session Detection Event WMI Response Event	The audit mode of the event. When true, no remediation actions were performed.
Auth Protocol	auth_protocol_id	Integer	User Session Object	The authentication protocol.
Authentication	authentication_id	Integer	Common Vulnerability Scoring System V2 Object	The authentication Common Vulnerability Scoring System (CVSS) metric.
Autoscale ID	autoscale_uid	String	Cloud Hosted VM Object	The unique identifier of the cloud autoscale configuration.
Availability Impact	availability_impact_id	Integer	Common Vulnerability Scoring System V2 Object	The availability impact Common Vulnerability Scoring System (CVSS) metric.
Average CPU	cpu_average	Long	CPU Usage Event	Average CPU.
BSSID	bssid	String	Network Information Object	The Basic Service Set Identifier (BSSID).
Banner	banner	String	Email Delivery Event	The initial SMTP connection response that a messaging server receives after it connects to a email server.
Base Address	base_address	String	Module Object	The memory address where the module was loaded.
Binding Information	binding	String	Remote Procedure Call (RPC) Object	The remote procedure call protocol family, hostname, and endpoint connection.
CVE	cve	Common Vulnerabilities and Exposures	Compliance Event	Common Vulnerabilities and Exposures (CVE).
CVE ID	cve_uid	String	Threat Object	The common vulnerabilities and exposures (CVE) identifier.
CVSSV2	cvssv2	Common Vulnerability Scoring System V2	Compliance Event	The Common Vulnerabilities Scoring System V2 (CVSSV2) base metrics.
Categories	categories	String Array	Uniform Resource Locator (URL) Object	The array of URL categories.
Category	category_id	Integer	Common Attributes Rule Object	The category of the event or object. See specific usage.
Category IDs	category_ids	Integer Array	Uniform Resource Locator (URL) Object	The array of URL categories.
Channel	channel_id	Integer	Update Event Update Available Event	The channel that was used to update the component.
Cipher	cipher	String	Transport Layer Security Object	The encryption algorithm.
Cipher Size	cipher_size	Integer	Transport Layer Security Object	Cipher size of the OpenSSL cipher suite negotiated for the client or server connection.
Cipher Strength	cipher_strength	Integer	Transport Layer Security Object	Strength of the OpenSSL cipher suite negotiated for the client or server connection.
City	city	String	Location Object	The name of the city.
Class	class	String	Peripheral Device Object WMI Instance Object	The class of the peripheral device.
Classification	classification	String	Threat Object	The threat classification.
Classification IDs	classification_ids	Integer Array	Threat Object	The array of threat classifications.
Cleartext Credentials	cleartext_credentials	Boolean	User Session Object	Indicates whether the credentials were passed in clear text. Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text.
Client Certificate	client_certificate	Certificate	Transport Layer Security Object	Client certificate details.
Client Domain	client_domain	String	File Content Detection Event	The CloudSOC client domain name.
Client ID	client_uid	String	Action Request Event Action Response Event	The OAUTH 2.0 Client ID.
Client User	client_user	String	File Content Detection Event	The CloudSOC client user name.
Cloud Resource ID	cloud_resource_uid	String	User Object	The unique identifier of the cloud resource.
Collected Time	log_time	Datetime	Common Attributes	The time that the system collected the event. Note: The internal time format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Collector Device IP	collector_device_ip	IP Address	Common Attributes	The IP address of the collector device in either IPv4 or IPv6 format.
Collector Device Name	collector_device_name	String	Common Attributes	The name of the collector device.
Collector ID	collector_uid	String	Common Attributes	The unique identifier of the collector.
Collector Name	collector_name	String	Common Attributes	The name of the collector.
Command ID	command_uid	String	Action Request Event Action Response Event Administrative Group Query Event Command Activity Event DNS Query Event Directory Query Event Directory Remediation Event File Query Event File Remediation Event Job Query Event Job Remediation Event Kernel Object Query Event Kernel Remediation Event Module Query Event Module Remediation Event Network Information Query Event Network Query Event Network Remediation Event Peripheral Device Query Event Prefetch Query Event Process Query Event Process Remediation Event Registry Key Query Event Registry Key Remediation Event Registry Value Query Event Registry Value Remediation Event Scan Event Service Query Event Service Remediation Event Startup Application Query Event Startup Application Remediation Event Unsuccessful Query Event Unsuccessful Remediation Event User Query Event User Session Query Event User Session Remediation Event	The unique command identifier.
Command Line	cmd_line	String	Job Object Process Object Service Object Startup Application Object	The command line used to launch the startup application, service, process or job.
Command Name	command_name	String	Command Activity Event	The command that pertains to the event or object.
Command Reference ID	command_ref_uid	String	Command Activity Event	The command identifier that corresponds to the original command identifier.
Comment	comment	String	Entity Audit Event Incident Closure Event Incident Creation Event Incident Update Event Policy Override Audit Event User Session Audit Event	The user-provided comment.
Company Name	company_name	String	File Object Module Object	The name of the company that published the file. For example: "Microsoft Corporation".
Compliance Rule	compliance_rule	Compliance Rule	Compliance Event	The compliance rule that pertains to the event.
Compliant Device	device_is_compliant	Boolean	Common Attributes	The event occurred on a compliant device.
Component	component	String	File Detection Event Unscannable File Event	The name or relative pathname of a subcomponent of the data object, if applicable. For example: attachment.doc, attachment.zip/bad.doc, or part.mime/part.cab/part.uue/part.doc.
Composite Event	composite	Integer	Common Attributes	The type of composite event. See the Event Logging API for more information.
Compressed Size	size_compressed	Long	File Object Module Object	The compressed size of the object, in bytes.
Conclusion	conclusion	String	Incident Creation Event Incident Update Event	The conclusive description of the events that are associated with the incident.
Confidentiality	confidentiality_id	Integer	File Object Module Object	The file content confidentiality indicator.
Confidentiality Impact	confidentiality_impact_id	Integer	Common Vulnerability Scoring System V2 Object	The confidentiality impact Common Vulnerability Scoring System (CVSS) metric.
Configuration	config_path	String	Startup Application Configuration Change Event Startup Application Query Event	The file or registry key that holds the startup application configuration.
Connection	connection	Network Connection	Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Network Activity Event Network Detection Event Network Query Event Network Remediation Event	The network connection object that pertains to the event.
Connection Direction	connection_direction_id	Integer	Network Connection Object	The direction of the initiated connection.
Connection Reference Identifier	connection_ref_uid	String	Email Activity Event Email Detection Event Email File Activity Event Email File Detection Event Email URL Activity Event Email URL Detection Event File Activity Event File Detection Event	The reference to the network connection object that pertains to the event.
Container	container	Container	Common Attributes	The container that pertains to the event.
Container Network Information	networks	Network Info Array	Container Object	The network information objects that are associated with the container, one for each MAC address/IP address combination. Note: The first element of the array is the network information that pertains to the event.
Content Type	content_type_id	Integer	Update Event Update Available Event	The type of the content to which the update pertains.
Content Type	content_type	File Content Type	File Object Module Object	The file content type as defined by the STAR "File-typer" engine.
Continent	continent	String	Location Object	The name of the continent.
Coordinates	coordinates	Float Array	Location Object	A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. For example: [-73.983, 40.719].
Correlation ID	correlation_uid	String	Common Attributes	The unique identifier used to correlate events.
Count	count	Integer	Common Attributes License Information Object	The count related to the event or object.
Country	country	String	Location Object	The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. Note: The two letter country code should be capitalized. For example: "US" or "CA".
Create Mask	create_mask	Integer	Directory Activity Event	The create disposition mask.
Create Mask	create_mask_id	Integer	File Activity Event File Detection Event Registry Key Activity Event Registry Key Detection Event	The Windows setting that is required to create the object.
Created	created	Datetime	File Object Incident Creation Event Job Object Module Object	The time that the object was created. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Creator	creator	String	File Object Incident Creation Event Module Object	The name of the user who created the object. See specific usage.
Creator Process	creator_process	String	File Object Module Object	The name of the process that created (or downloaded) the file or module.
Criteria	criteria_id	Integer	Compliance Rule Object	The criteria that is associated with the rule.
Current Location	curr_location	Location	Policy Change Event	The current location.
Current Version	curr_ver	String	Update Event Update Available Event	The updated version of the code, content, configuration or policy.
Customer ID	customer_uid	String	Common Attributes	The unique customer identifier.
Customer Registry ID	customer_registry_uid	String	Common Attributes	The unique Symantec customer registry identifier.
CybOx	cybox	Cyber Observable eXpression	Common Attributes	The Cyber Observable eXpression (CybOX ^TM) attributes.
DKIM Domain	dkim_domain	String	Email Authentication Object	The DomainKeys Identified Mail (DKIM) signing domain of the email.
DKIM Signature	dkim_signature	String	Email Delivery Event	The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system.
DKIM Status	dkim_id	Integer	Email Authentication Object	The DomainKeys Identified Mail (DKIM) status of the email.
DLP Rule Type	dlp_type_id	Integer	Rule Object	The Data Loss Protection specific rule type.
DMARC Override	dmarc_override	String	Email Authentication Object	The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action.
DMARC Policy	dmarc_policy_id	Integer	Email Authentication Object	The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy..
DMARC Status	dmarc_id	Integer	Email Authentication Object	The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email.
Data	data	String	AMSI Activity Event Managed Entity Object Monitored Source Event Process Detection Event Registry Value Object	The data that is associated with the event or object. See specific usage.
Data Center Region	dc_region	String	Cloud Hosted VM Object	The data center region, as defined by the cloud vendor.
Data Size	data_size	Integer	AMSI Activity Event Process Detection Event	The size of the data prior to truncation.
Days Left	days_left	Integer	Certificate Expiry Event License Expiry Event	The number of days that remain before the license or certificate expires.
Default Value	is_default_value	Boolean	Registry Value Object	The indication of whether the value is from a default value name. For example, the value name could be missing.
Description	desc	String	Common Vulnerabilities and Exposures (CVE) Object Compliance Rule Object File Object Job Object Location Object Module Object Policy Object Rule Object Service Object Startup Application Object	The description that pertains to the object. See specific usage.
Destination Endpoint Application	dst_endpoint_app	Application Service	Host Network Activity Event Host Network Detection Event Network Activity Event Network Detection Event	Application details on the destination host.
Destination IP	dst_ip	IP Address	Network Connection Object	The IP address of the destination network connection device. The format is either IPv4 or IPv6.
Destination Location	dst_location	Location	Network Connection Object	Reports the location of the IP address to which the Web Security Service connected.
Destination MAC	dst_mac	String	Network Connection Object	The MAC address of the destination network connection device.
Destination Name	dst_name	String	Network Connection Object	The host name of the destination network connection device.
Destination Port	dst_port	Integer	Network Connection Object	The port number of the destination network connection.
Destination Service	dst_service	String	Network Connection Object	The destination network connection service name.
Detection ID	detection_uid	String	Boot Record Detection Event File Detection Event File Response Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Peripheral Device Detection Event Process Detection Event Process Response Event Registry Key Detection Event Registry Key Response Event Registry Value Detection Event Registry Value Response Event Startup App Response Event User Session Detection Event WMI Response Event	The associated unique detection event identifier. For example: detection response events include the Detection ID of the original event.
Detection Time	detected	Datetime	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Print/FAX Content Detection Event	The time that the threat was detected.
Detection Type	detection_type	String	Incident Creation Event Incident Update Event	The incident detection type.
Detection Version	content_ver	String	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Activity Event Process Detection Event Process History Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event User Session Activity Event User Session Detection Event	The version of the detection engine or signature content. Note: AV, SONAR, and IPS have differing version string formats.
Detections	num_detections	Integer	Scan Event	The number of detections.
Device Alias	device_alias_name	String	Common Attributes	The alternate device name, ordinarily as assigned by an administrator.
Device BIOS Date	device_hw_bios_date	String	Common Attributes	The BIOS date. For example: "03/31/16".
Device BIOS Manufacturer	device_hw_bios_manufacturer	String	Common Attributes	The BIOS manufacturer. For example: "LENOVO".
Device BIOS Version	device_hw_bios_ver	String	Common Attributes	The BIOS version. For example: "LENOVO G5ETA2WW (2.62)".
Device Caption	device_cap	String	Common Attributes	A short description or caption of the device. For example: "ATP Scanner 1 " or " CSP Manager".
Device Cloud VM	device_cloud_vm	Cloud Hosted VM	Common Attributes	The cloud-hosted virtual machine.
Device Description	device_desc	String	Common Attributes	The description of the device, ordinarily as reported by the operating system.
Device Domain	device_domain	String	Common Attributes	The network domain where the device resides. For example: "internal.somecompany.com".
Device Domain ID	device_domain_uid	String	Common Attributes	The unique identifier of the domain where the device resides.
Device End Time	device_end_time	Datetime	Common Attributes	The time of the last aggregated event. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC, and this value must be greater than or equal to the Device Time (device_time) value.
Device Gateway	device_gateway	IP Address	Common Attributes	The gateway IP address. For example: "10.0.0.1".
Device Group	device_group	String	Common Attributes	The full path of the group to which the device belongs. For example: West Coast\Windows Laptops.
Device Group Name	device_group_name	String	Common Attributes	The name of the leaf group to which the device belongs. For example: Windows Laptops.
Device ID	device_uid	String	Common Attributes	The unique identifier of the device.
Device IMEI	device_imei	String	Common Attributes	The International Mobile Station Equipment Identifier that is associated with the device.
Device IP Address	device_ip	IP Address	Common Attributes	The IP address that pertains to the event, in either IPv4 or IPv6 format. Note: Because the IP address of a device can change, the IP address must be captured when the event occurs, which may be different from when the event is sent. If additional network information is pertinent to the event, also populate Device Network Information (device_networks).
Device Location	device_location	Location	Common Attributes	The location of the device at the time of the event.
Device MAC Addresses	device_mac	String	Common Attributes	The Media Access Control (MAC) address that is associated with the device.
Device MD5	device_name_md5	String	Common Attributes	The MD5 hash of the device name. Note: The hash must be of the lower-case device name.
Device Name	device_name	String	Common Attributes	The name of the device originating the event. Note: The Device Name is ordinarily the host name, but could be any other string that helps to identify the device, such as a phone number; for example "computer.domain" or "310.555.1234".
Device Network Information	device_networks	Network Info Array	Common Attributes	The network information objects that are associated with the device, one for each MAC address/IP address combination. Note: The first element of the array is the network information that pertains to the event.
Device OS	device_os_name	String	Common Attributes	The name of the operating system running on the device from which the event originated. For example: "Windows 10 Home Basic", "Mac OS X", "iOS", or "Android".
Device OS Bits	device_os_bits	Integer	Common Attributes	The number of processor bits. For example: 64 or 128.
Device OS Build	device_os_build	String	Common Attributes	The operating system build number.
Device OS Country Code	device_os_country	String	Common Attributes	The operating system country code as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see ISO 3166-1 alpha-2 codes.
Device OS Edition	device_os_edition	String	Common Attributes	The operating system edition. For example: "Professional".
Device OS Integrity Protection	device_os_integrity_protection	Boolean	Service Object Startup Application Object	The operating system integrity protection status.
Device OS Language	device_os_lang	String	Common Attributes	The lowercase two-letter ISO language code as defined by ISO 639-1. For example: "en", "de", or "fr".
Device OS Service Pack	device_os_sp_name	String	Common Attributes	The name of the latest Service Pack.
Device OS Service Pack Version	device_os_sp_ver	String	Common Attributes	The version number of the latest Service Pack.
Device OS Type	device_os_type_id	Integer	Common Attributes	The type of the operating system.
Device OS Version	device_os_ver	String	Common Attributes	The version of the OS running on the device that originated the event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
Device Org Unit	device_org_unit	String	Common Attributes	The name of the org unit to which the device belongs.
Device Org Unit ID	org_unit_uid	String	Common Attributes	The unique identifier of the organizational unit.
Device Processor Type	device_hw_cpu_type	String	Common Attributes	The processor type. For example: "x86 Family 6 Model 37 Stepping 5".
Device Proxy IP	device_proxy_ip	IP Address	Common Attributes	The proxy IP address.
Device Proxy Name	device_proxy_name	String	Common Attributes	The proxy host name. For example: "localproxy".
Device Public IP	device_public_ip	IP Address	Common Attributes	The public IP address. Note: The Device Public IP is populated with the value of the x-forwarded-for message header, if present. .
Device Reference ID	device_ref_uid	String	Common Attributes	The unique reference identifier of the device.
Device Site	device_site	String	Common Attributes	The name of the site to which the device belongs.
Device Subnet	device_subnet	IP Address	Common Attributes	The subnet IP address. For example: "255.0.0.0".
Device Time	device_time	Datetime	Common Attributes	The time that the event occurred at the device. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC. The event producer or the event collection agent that detects the event provides the event Device Time.
Device Type	device_type	String	Common Attributes	The type of device originating the event. For example: "unknown", "server", "desktop", "laptop", "tablet", "mobile", "virtual", "browser", or "other".
Device Virtual Host Type	device_vhost_id	Integer	Common Attributes	The device virtual host type.
Device Virtual Host Type String	device_vhost	String	Common Attributes	The device virtual host type string.
Direction	direction_id	Integer	Email Object File Content Detection Event Network Connection Object User Session Object	The direction of the initiated traffic.
Directory	directory	File	Directory Activity Event Directory History Event Directory Query Event Directory Remediation Event	The directory that pertains to the event.
Directory Result	directory_result	File	Directory Activity Event	The directory that is the result of the event.
Display Name	display_name	String	Service Object	The service display name.
Displayed Text	displayed_text	String	Policy Override Audit Event	The information that is displayed to the user that describes the impact of a client side override action.
Domain	domain	String	User Object	The name of the domain.
Domain ID	domain_uid	String	Common Attributes	The unique domain identifier.
Domains	domains	String Array	Cyber Observable eXpression Object	The domains that pertain to the event. See specific usage.
Download Bytes	bytes_download	Long	Network Connection Object	The number of bytes downloaded from the source to the destination.
Duration	duration	Integer	Scan Event	The duration of the scan (seconds).
Effective Date	effective_date	Datetime	Policy Object	The date and time that the specific policy and rule was applied and became operational. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Email	email	Email	Email Activity Event Email Content Detection Event Email Delivery Event Email Detection Event	The email that pertains to the event.
Email Attacks	email_attacks	JSON Array	Email Analytics Event	The email threat analytics report.
Email Authentication	email_auth	Email Auth	Email Activity Event Email Detection Event	The SPF, DKIM and DMARC attributes of an email.
Email ID	email_uid	String	Email Activity Event Email Delivery Event Email Detection Event Email File Activity Event Email File Detection Event Email URL Activity Event Email URL Detection Event	The unique identifier of the email, used to correlate related email detection and activity events.
Emails	emails	Email Array	Cyber Observable eXpression Object	The emails that pertain to the event. See specific usage.
End Time	end_time	Datetime	Certificate Object Common Attributes License Information Object	The end time that pertains to the event or object. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Entity	entity	Managed Entity	Application Lifecycle Event Application Log Event Command Activity Event Entity Audit Event Entity Change Event File Content Detection Event File Detection Event File Response Event License Expiry Event Scan Event Status Event Unscannable File Event Update Event	The managed entity that pertains to the event.
Entity Result	entity_result	Managed Entity	Entity Audit Event Entity Change Event	The updated managed entity.
Environment ID	environment_uid	String	Entity Audit Event Policy Override Audit Event User Session Audit Event	The unique identifier of the provisioned environment.
Environment Name	environment_name	String	Entity Audit Event Policy Override Audit Event User Session Audit Event	The environment in which the event occurred such as Production, Test, Development, Load.
EoC Remediation Request	eoc_request	JSON	Unsuccessful Query Event Unsuccessful Remediation Event	An object describing the Evidence of Compromise (EoC) remediation request.
Error Files	num_errors	Integer	Scan Event	The number of files with either scanning or remediation errors.
EtherType	ether_type	Integer	Network Connection Object	The EtherType indicates which protocol is encapsulated in the payload of an Ethernet frame.
Event Duration	event_duration	Long	Host Network Activity Event Host Network Detection Event Network Activity Event Network Detection Event	Time taken (in milliseconds) to process the request (from the first byte of client request data received by the proxy to the last byte sent by the proxy to the client including all of the delays by ICAP and so on).
Event ID	event_id	Integer	Common Attributes	The event ID identifies the event's semantics, structure and outcome.
Event Time	time	Datetime	Common Attributes	The event occurrence time (Device Time) adjusted to the server clock. Note: The internal time format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Event Unique ID	uuid	String	Common Attributes	The system-assigned unique identifier of an event occurrence.
Events	events	JSON Array	Common Attributes	The additional events that pertain to the event or incident.
Events per Second	throughput_eps	Integer	Throughput Event	The number of events processed per second.
Exception	status_exception	String	Application Log Event Status Event	The operating system exception message.
Extended Attributes	xattributes	JSON	File Object Module Object Process Object	An unordered collection of zero or more name/value pairs where each pair represents a file or directory extended attribute. For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS: ads_name ads_size dacl owner primary_group link_name - name of the link associated to the file. hard_link_count - the number of links that are associated to the file. Unix_permissions - Unix permissions notation style for user, group and others to access the file, including notations for setuid, setgid and sticky bit settings. For example "rwxrw-r—", "r-xr-sr-x", "rwxrwxrwt".
Extension	extension	String	Uniform Resource Locator (URL) Object	Document extension from the original URL requested.
External Account ID	external_account_uid	String	User Object	The user's external account unique identifier.
External ID	external_uid	String	User Object	The user's external unique identifier.
Facility	facility	String	Event Source Object	The subsystem or application that is providing the event data.
Facility Detail	facility_detail	String	Event Source Object	Additional detail about the source facility. For example, details could include a the name of a particular application instance (such as a database name) or a path to a monitored log file.
Facility ID	facility_uid	String	Event Source Object	The unique identifier of the facility.
Family	family_id	Integer	File Content Type Object	The top level file classification.
Feature ID	feature_uid	String	Common Attributes	The unique identifier of the feature originating the event.
Feature Name	feature_name	String	Common Attributes	The name of the feature originating the event. Note: The Feature Name is ordinarily defined by the product SKU, but it could be any other name that identifies the software component originating the event. For example: "Live Update".
Feature Path	feature_path	String	Common Attributes	The path of the feature originating the event.
Feature Type	feature_type	String	Common Attributes	The type of feature.
Feature Version	feature_ver	String	Common Attributes	The version of the feature originating the event. For example: "2014.1.3.64".
File	file	File	Email File Activity Event Email File Detection Event File Activity Event File Content Detection Event File Detection Event File History Event File Query Event File Remediation Event File Reputation Event File Response Event Job Object Peripheral Device Detection Event Policy Override Audit Event Print/FAX Content Detection Event Process Object Service Object Startup Application Object Unscannable File Event	The file that pertains to the event or object. See specific usage.
File Diff	file_diff	String	File Activity Event File Detection Event	File content differences used for change detection. For example, a common use case is to identify itemized changes within INI or configuration/property setting values.
File Result	file_result	File	File Activity Event File Detection Event File History Event File Reputation Event	The resulting file object. For example, if a file operation is allowed, the resulting file object can be included in the event.
Files	files	File Array	Cyber Observable eXpression Object	The files that pertain to the event. See specific usage.
First Seen	first_seen	Datetime	File Content Detection Event	The initial detection time of the threat.
Folder	folder	String	File Object Module Object	The parent folder in which the file resides. For example: "c:\windows\system32".
Folder ID	folder_uid	String	File Object Module Object	The unique identifier of the folder in which the file resides.
Free Memory	mem_free	Long	Memory Usage Event	The Java Virtual Machine® (JVM) free memory (in bytes).
From	header_from	String	Email Object	The email header From values, as defined by RFC 5322.
Full Name	full_name	String	User Object	The full name of the entity.
Gateway IP Address	gateway_ip	IP Address	Network Information Object	The gateway IP address. For example: "10.0.0.1".
Gateway MAC Address	gateway_mac	String	Network Information Object	The gateway media access control (MAC) address.
Group Description	group_desc	String	Policy Object	The description of the group to which the policy belongs.
Group ID	gid	Integer	Administrative Group Query Event	The administrative group identifier.
Group ID	group_uid	String	Policy Object	The unique identifier of the group to which the policy belongs.
Group Name	group_name	String	Policy Object	The name of the group to which the policy belongs.
Group Name	group	String	Administrative Group Query Event	The name of the administrative group.
Groups	groups	String Array	Application Service Object User Object	The administrative groups to which the user belongs.
HTTP Status	http_status	Integer	Action Response Event Email URL Detection Event Network Connection Object	The HTTP status code returned to the client.
HTTP User-Agent	http_user_agent	String	File Content Detection Event Network Connection Object	The request header that is used to identify the operating system and web browser.
Home	home	String	User Object	The user's home directory.
Host Name	host_name	String	Container Object DNS Query Event	The hostname that pertains to the event or object. See specific usage.
Host Name	host	String	Uniform Resource Locator (URL) Object	The host name of the URL.
Host Names	hostnames	String Array	Cyber Observable eXpression Object	The host names that pertains to the event or object. See specific usage.
IANA Service Name	svc_name	String	Network Connection Object	The service name as defined by the Internet Assigned Numbers Authority (IANA). See Service Name and Transport Protocol Port Number Registry.
ICAP Reqmod	icap_reqmod	ICAP Reqmod	Cyber Observable eXpression Object	The array of CybOX ICAP Request Modifications.
ICAP Respmod	icap_respmod	ICAP Respmod	Cyber Observable eXpression Object	The array of CybOX ICAP Response Modifications.
ID	uid	String	Common Vulnerabilities and Exposures (CVE) Object Compliance Rule Object Container Object File Object License Information Object Managed Entity Object Module Object Network Connection Object Policy Object Process Object Rule Object User Object	The unique identifier that pertains to the event or object. See specific usage.
IPv4 Address	ipv4	IP Address	DNS Query Event Network Information Object	The IPv4 address that is associated with the network interface.
IPv4 Addresses	ipv4s	IP Address Array	Cyber Observable eXpression Object	The IPv4 addresses that pertain to the event. See specific usage.
IPv6 Address	ipv6	IP Address	DNS Query Event Network Information Object	The IPv6 address that is associated with the network interface.
IPv6 Addresses	ipv6s	IP Address Array	Cyber Observable eXpression Object	The IPv6 addresses that pertain to the event. See specific usage.
ISP	isp	String	Location Object	The name of the Internet Service Provider (ISP).
Identifier	id	Integer	Common Attributes Threat Object User Session Object	The identifier of the entity or the disposition of the event. See specific usage.
Idle CPU	cpu_idle	Long	CPU Usage Event	Idle CPU.
Image ID	image_uid	String	Container Object	The container unique image identifier.
Image Name	image_name	String	Container Object	The container image name.
Impersonator Customer ID	impersonator_customer_uid	String	Common Attributes	The unique customer identifier of the impersonating agent.
Impersonator Domain ID	impersonator_domain_uid	String	Common Attributes	The unique domain identifier of the impersonating agent.
Impersonator User ID	impersonator_user_uid	String	Common Attributes	The unique user identifier of the impersonating agent.
Incident ID	incident_uid	String	Incident Associate Event Incident Closure Event Incident Creation Event Incident Update Event	The incident unique identifier.
Incident URL	incident_url	String	Incident Associate Event Incident Closure Event Incident Creation Event Incident Update Event	The URL used to access the original incident.
Injection Type	injection_type_id	Integer	Process Activity Event Process Detection Event	The process injection method.
Instance ID	instance_uid	String	Cloud Hosted VM Object Peripheral Device Object	The unique identifier of the instance that pertains to the event or object. See specific usage.
Integrity Impact	integrity_impact_id	Integer	Common Vulnerability Scoring System V2 Object	The integrity impact Common Vulnerability Scoring System (CVSS) metric.
Integrity Level	integrity_id	Integer	Process Object	The process integrity level (Windows only).
Interface ID	interface_uid	String	Remote Procedure Call (RPC) Object	The unique identifier of the remote procedure call interface.
Interface Version	interface_ver	String	Remote Procedure Call (RPC) Object	The remote procedure call interface version.
Interpreter	interpreter	String	Command Activity Event	The script interpreter used. For example: "CMD", "POWERSHELL", "VBSCRIPT", "JAVASCRIPT".
Issuer Keyring	issuer_keyring	String	Transport Layer Security Object	Issuer for forged certificates.
Issuer Keyring Alias	issuer_keyring_alias	String	Transport Layer Security Object	Key alias name in HSM issuer for forged certificates.
Issuer Name	issuer_name	String	Certificate Object	The certificate issuer name.
Issuer Organization	issuer_organization	String	Certificate Object	The certificate issuer organization.
Job	job	Job	Job Query Event Job Remediation Event	The job object that pertains to the event.
Kernel	kernel	Kernel Resource	Kernel Activity Event Kernel Detection Event Kernel Object Query Event Kernel Remediation Event	The kernel resource object that pertains to the event.
Key Length	key_length	Integer	Transport Layer Security Object	The length of the encryption key.
Kilobytes per Second	throughput_kbps	Integer	Throughput Event	The number of kilobytes of data processed per second (kB/s).
Label	label	String	Policy Object	The label set for the policy.
Last Run	last_run	Datetime	Job Object Prefetch Query Event	The last run time that pertains to the event. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Last Written	last_write	Datetime	Registry Key Object Registry Value Object	The last write time that pertains to the event or object. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
License	license	License Information	License Expiry Event License Lifecycle Event	The license information that pertains to the event.
Lineage	lineage	String Array	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Object Process Activity Event Process Detection Event Process History Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event User Session Activity Event User Session Detection Event	The lineage of the actor process.
Load Type	load_type_id	Integer	Module Object	The load type identifies how the module was loaded in memory.
Load Type	load_type	String	Module Object	The load type describes how the module was loaded in memory.
Loaded Module	loaded_module_name	String	Service Object	The name of the module loaded by the service.
Loaded Modules	loaded_modules	String Array	Process Object	The list of loaded module names.
Local	local	Boolean	Network Connection Object	The indication of whether the connection is between two endpoints on the same device. For example, if Source IP (src_ip) and Destination IP (dst_ip) could be the same.
Log Level	log_level	String	Common Attributes	The log level as reported by the logger subsystem.
Log Name	log_name	String	Common Attributes	The name of the database, index, or archive where the event was logged.
Logging Device ID	logging_device_ref_uid	String	Common Attributes	The unique identifier of the device that collects logs from other devices.
Logging Device IP	logging_device_ip	IP Address	Common Attributes	The IP address of the device that logged the event.
Logging Device Name	logging_device_name	String	Common Attributes	The name of the device that logged the event.
Logging Device Time	logging_device_post_time	Datetime	Common Attributes	The time when the event was logged by the logging device. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Logon Name	logon_name	String	User Object	The logon name of the entity.
Logon Type	logon_type_id	Integer	User Session Object User Session Activity Event	The type of logon.
MAC Address	mac	String	Network Information Object	The MAC address that is associated with the network interface.
MAC Addresses	macs	String Array	Cyber Observable eXpression Object	The MAC addresses that are associated with the network interface. See specific usage.
MD5	md5	String	File Object Module Object	The MD5 checksum of the object content.
MIME type	mime_type	String	File Object Module Object	The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable.
Major Device Class	major_device_class	String	Peripheral Device Object	The peripheral device usage category.
Maximum Memory	mem_max	Long	Memory Usage Event	The Java Virtual Machine® (JVM) maximum memory (in bytes).
Message	message	String	Common Attributes	The description of the event.
Message Code	message_code	String	Common Attributes	The coded string representation of the message, ordinarily used for trouble shooting.
Message ID	message_id	String	Common Attributes	The numeric representation of the message, ordinarily used for translation purposes.
Message ID	header_message_id	String	Email Object	The email header Message-Id value, as defined by RFC 5322.
Metadata	metadata	JSON	ICAP Request Modification Object ICAP Response Modification Object	Request or Response header details.
Method	method	String	Uniform Resource Locator (URL) Object	The HTTP method used in the URL request.
Model	model	String	Peripheral Device Object	The peripheral device model.
Modified	modified	Datetime	File Object Incident Update Event Module Object	The time when the object was last modified. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Modifier	modifier	String	File Object Incident Update Event Module Object	The name of the user who last modified the object. See specific usage.
Module	module	Module	Module Activity Event Module Detection Event Module Query Event Module Remediation Event Process Object	The module that pertains to the event.
Module Type	module_type	String	Module Detection Event Module Query Event Module Remediation Event	The type of module.
Name	name	String	API Object Application Service Object Common Vulnerabilities and Exposures (CVE) Object Compliance Rule Object Container Object File Object Job Object Kernel Resource Object License Information Object Managed Entity Object Module Object Peripheral Device Object Policy Object Prefetch Query Event Printer Object Registry Value Object Rule Object Service Object Startup Application Object Threat Object User Object	The name of the entity. See specific usage.
Namespace	namespace	String	WMI Instance Object	The namespace containing the class.
Net Detection ID	net_detection_uid	String	File Detection Event	The unique identifier of the network detection event that is associated with this event.
Network Information	network	Network Info	Network Information Query Event	The network information object that is associated with the event.
Next Run	next_run	Datetime	Job Object	The next run time that pertains to the event. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Normalized Command Line	normalized_cmd_line	String	Job Object Process Object Service Object Startup Application Object	The CSIDL normalized command line used to launch the startup application, service, process or job (Windows only).
Normalized Path	normalized_path	String	File Object Module Object	The CSIDL normalized path name. For example: "CSIDL_SYSTEM\svchost.exe" (Windows only).
OCSP Status Detail	ocsp_status_detail	String	Transport Layer Security Object	Errors observed during OCSP check of server certificate.
OS Code	status_os	String	Common Attributes	The operating system result code.
OS Code Source	status_os_src	Integer	Common Attributes	The indication of whether the OS Code (status_os) returned to the application for the requested operation was returned by the OS (0) or generated by the security product (1).
OS Name	os_name	String	Container Object	The container operating system name.
On Premises	on_premises	Boolean	Location Object	The indication of whether the location is on premises.
Open Mask	open_mask_id	Integer	Registry Key Activity Event Registry Key Detection Event	The Windows setting that is required to open the object.
Open Mode	open_mode	Boolean	Directory Activity Event File Activity Event File Detection Event	The mode in which the file or folder was opened.
Operation	operation	String	Application Service Object Directory Activity Event Directory History Event File Activity Event File History Event Process Activity Event Process Detection Event Process History Event	The operating system operation that initiated the event.
Operation Number	interface_op	Integer	Remote Procedure Call (RPC) Object	The remote procedure call interface operation number.
Original Data	orig_data	String	Common Attributes	The pre-normalized event data.
Original Event ID	ref_orig_uid	String	Common Attributes	The unique identifier of the external event that corresponds to Reference Event ID (ref_uid) ,if applicable.
Original Name	original_name	String	File Object Module Object	The original name of the file.
Override Duration	override_duration	Integer	Policy Override Audit Event	The length in minutes for the override action to remain in place until restored upon expiration of time. If not provided it implies infinite duration of policy enforcement or until such time as another policy action occurs.
Owner	owner	String	File Object Module Object	The owner of the file.
Owner	data_owner_name	String	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Print/FAX Content Detection Event	The name of the data owner.
Owner Email	data_owner_email	String	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Print/FAX Content Detection Event	The email address of the data owner.
Parameters	parameters	JSON	API Object	An unordered collection of name/value pairs where each pair represents parameters associated with the API.
Parent Categories	parent_categories	String Array	Uniform Resource Locator (URL) Object	The array of parent URL categories.
Parent File	parent_name	String	File Object Module Object	The name of the file that contains this file.
Parent Process	parent	Process	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event File Reputation Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Module Query Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Activity Event Process Detection Event Process History Event Process Query Event Process Remediation Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event URL Reputation Event User Session Activity Event User Session Detection Event	The parent process of the process associated with the event. See specific usage.
Parent SHA2	parent_sha2	String	File Object Module Object	The SHA-256 checksum of the parent file.
Password Expires	password_expires	Boolean	User Object	The indication of whether the user's password is configured to expire.
Path	path	String	File Object Module Object Registry Key Object Registry Value Object Uniform Resource Locator (URL) Object WMI Instance Object	The path that pertains to the event or object. See specific usage.
Peripheral Device	peripheral_device	Peripheral Device	Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Peripheral Device Query Event	The peripheral device that pertains to the event.
Personal Device	device_is_personal	Boolean	Common Attributes	The event occurred on a personal device.
Policy	policy	Policy	AMSI Activity Event API Activity Event Administrative Group Query Event Boot Record Detection Event Clipboard Content Detection Event Compliance Event Compliance Scan Event Content Detection Event DNS Query Event Directory Activity Event Directory History Event Directory Query Event Email Content Detection Event File Activity Event File Content Detection Event File Detection Event File History Event File Query Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Instant Message Content Detection Event Job Query Event Kernel Activity Event Kernel Detection Event Kernel Object Query Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Module Query Event Monitored Source Event Network Detection Event Network Information Query Event Network Query Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Peripheral Device Query Event Policy Change Event Policy Override Audit Event Prefetch Query Event Print/FAX Content Detection Event Process Activity Event Process Detection Event Process History Event Process Query Event Registry Key Activity Event Registry Key Detection Event Registry Key Query Event Registry Value Activity Event Registry Value Detection Event Registry Value Query Event Scan Event Service Query Event Startup Application Configuration Change Event Startup Application Query Event User Query Event User Session Activity Event User Session Detection Event User Session Query Event	The policy that pertains to the event.
Policy Change Type	change_type_id	Integer	Policy Change Event	The reason for the policy change.
Port	port	Integer	Uniform Resource Locator (URL) Object User Session Object	The port that is associated with the event or object. See specific usage.
Previous Location	prev_location	Location	Policy Change Event	The previous location.
Previous Security Level	prev_security_level_id	Integer	Entity Change Event	The previous security level of the entity.
Previous Security States	prev_security_state_ids	Integer Array	Entity Change Event	The previous security states of the entity.
Previous Users	previous_users	String Array	User Session Object	An ordered list of the previous user names used within in the session, from latest to earliest.
Previous Version	prev_ver	String	Update Event Update Available Event	The pre-update version of the code, content, configuration or policy.
Print Job	print_job	String	Print/FAX Content Detection Event	The name of the print or FAX job.
Printer	printer	Printer	Print/FAX Content Detection Event	The printer associated with the event.
Priority	priority_id	Integer	Incident Closure Event Incident Creation Event Incident Update Event	The incident priority.
Privileges	privileges	String Array	Action Request Event	The user privileges.
Process	process	Process	Application Log Event Module Query Event Monitored Source Event Network Query Event Process Activity Event Process Detection Event Process History Event Process Query Event Process Remediation Event Process Response Event Service Query Event Status Event	The process that pertains to the event.
Process ID	pid	Integer	Process Object	The process identifier, as reported by the operating system.
Product Data	product_data	JSON	Common Attributes	The event attributes that are specific to the reporting product.
Product ID	product_uid	String	Common Attributes	The unique identifier of the product originating the event.
Product Language	product_lang	String	Common Attributes	The two letter lower case language codes as defined by ISO 639-1. For example: "en" (English), "de" (German), or "fr" (French).
Product Name	product_name	String	Common Attributes File Object Module Object	The name of the product that pertains to the event or object. See specific usage.
Product Path	product_path	String	File Object Module Object	The path to the product that includes the file.
Product Version	product_ver	String	Common Attributes	The version of the product. Note: The version is as defined by the product SKU, originating the event. For example: "2013.1.3-beta".
Protocol	protocol_id	Integer	Network Connection Object	The network protocol as defined by RFC1340. For example: TCP=6 and UDP=17.
Protocol Version	protocol_version	Integer	Network Connection Object	The version of the network protocol.
Provider	provider	String	Threat Object Uniform Resource Locator (URL) Object	The origin of the reputation and category information. For example: "CAS", "CASMA", "Cynic", "Skeptic", or "Synapse".
Proxy Connection	proxy_connection	Network Connection	Network Activity Event Network Detection Event	If a proxy connection is present, the connection from the proxy server to the remote destination server.
Proxy Device IP	proxy_device_ip	IP Address	Common Attributes	The IP address of the proxy device that is collecting events from other devices. For example: the IP address of a Windows Domain controller. The format is either IPv4 or IPv6.
Proxy Device Name	proxy_device_name	String	Common Attributes	The name of the proxy device that is collecting events from other devices.
Public Network	is_public	Boolean	Network Information Object	The indication of whether the network interface is a public IP address.
Published	published	Datetime	Common Vulnerabilities and Exposures (CVE) Object	The date and time the CVE Record was first published in the CVE List.
Quarantine ID	quarantine_uid	String	Email Detection Event Email File Detection Event Email URL Detection Event File Detection Event File Response Event Module Detection Event Process Detection Event Process Response Event Startup App Response Event WMI Response Event	The unique identifier of the item that was quarantined or restored from quarantine.
Query	query	String	Uniform Resource Locator (URL) Object	The query portion of the URL. For example: the query portion of the URL "http://www.example.com/search?q=bad&sort=date" is "q=bad&sort=date".
RPC	rpc	Remote Procedure Call	Network Connection Object	The RPC object that pertains to the network connection.
Raw Data	raw_data	String	Common Attributes	The event data as received.
Raw Header	raw_header	String	Email Authentication Object	The email authentication header.
Reason	reason	String	Boot Record Detection Event File Detection Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Peripheral Device Detection Event Process Detection Event Registry Key Detection Event Registry Value Detection Event User Session Detection Event	The reason for the detection.
Reason	reason_id	Integer	Boot Record Detection Event Email Detection Event Email File Detection Event Email URL Detection Event File Detection Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Network Detection Event Peripheral Device Detection Event Process Detection Event Registry Key Detection Event Registry Value Detection Event User Session Detection Event	The reason for the detection.
Recipient	recipient	String	Email Activity Event Email Detection Event	The Click-time protection email to address.
Recovery Key ID	recovery_key_uid	String	BitLocker Event	The unique identifier of the recovery key of the volume.
Reference Event ID	ref_uid	String	Common Attributes	The unique external original message or event identifier that was used to record the event. For example: the Windows Event Log Event ID, the SEPM event UID, or the SYSLOG msgid.
Reference Event Log Name	ref_log_name	String	Common Attributes	The log name of the reference event.
Reference Event Log Time	ref_log_time	Datetime	Common Attributes	The log time of the reference event. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Reference Incident ID	ref_incident_uid	String	Incident Creation Event Incident Update Event	The unique identifier of the original incident.
Reference URL	reference_url	String	Common Vulnerabilities and Exposures (CVE) Object	The URL associated with the CVE.
Referrer	referrer	String	Uniform Resource Locator (URL) Object	The address accessed prior to this one.
Referrer Categories	referrer_categories	String Array	Uniform Resource Locator (URL) Object	All content categories of the Referrer header URL.
Referrer Category IDs	referrer_category_ids	Integer Array	Uniform Resource Locator (URL) Object	The array of Referrer URL categories IDs.
Region	region	String	Location Object	The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For examples, see the region codes for the US.
Registry Key	reg_key	Registry Key	Registry Key Activity Event Registry Key Detection Event Registry Key Query Event Registry Key Remediation Event Registry Key Response Event	The registry key that pertains to the event.
Registry Key Result	reg_key_result	Registry Key	Registry Key Activity Event Registry Key Detection Event	The registry key that is the result of the event.
Registry Value	reg_value	Registry Value	Registry Value Activity Event Registry Value Detection Event Registry Value Query Event Registry Value Remediation Event Registry Value Response Event	The registry value that pertains to the event.
Registry Value Result	reg_value_result	Registry Value	Registry Value Activity Event Registry Value Detection Event	The registry value that is the result of the event.
Remediated	remediated	Boolean	Common Attributes	The indication of whether the event was remediated.
Remediation	remediation	String	Common Attributes	The remediation information.
Remediation ID	remediation_uid	String	Common Attributes	The unique identifier of the remediation information.
Remediation Reference	remediation_ref	String	Common Attributes	The reference to remediation information. Note: The information can be either internal or external to the reporting product.
Remote	remote	Boolean	User Session Object	The indication of whether the session is remote.
Remote Device Name	remote_device_name	String	Monitored Source Event	The name of the device associated with the remote process.
Remote Host	remote_host	String	User Session Object	The host name of the device associated with the remote session.
Remote IP	remote_ip	IP Address	User Session Object	The IP address of the device associated with the remote session. The format is either IPv4 or IPv6.
Remote Process	remote_process	Process	Monitored Source Event	The remote process that performed the operation or action on the target object.
Reply To	header_reply_to	String	Email Object	The email header Reply-To values, as defined by RFC 5322.
Reputation Discovered	rep_discovered_date	Datetime	File Object Module Object	The Symantec discovery date of the reputed file or URL. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Reputation Discovered Band	rep_discovered_band	Integer	File Object Module Object	The discovery fuzzed band number, expressed as the number of days since discovery.
Reputation Prevalence	rep_prevalence	Integer	File Object Module Object	The file reputation prevalence, as provided by a reputation query.
Reputation Prevalence Band	rep_prevalence_band	Integer	File Object Module Object	The file reputation prevalence fuzzed band number.
Reputation Score	rep_score_id	Integer	Network Information Object Uniform Resource Locator (URL) Object	The reputation score of the URL.
Reputation Score	rep_score	Integer	File Object Module Object	The reputation score of the file.
Reputation Score Band	rep_score_band	Integer	File Object Module Object	The file reputation score fuzzed band number.
Request Headers	request_headers	JSON	Email URL Detection Event Network Connection Object	The additional information associated with and HTTP request.
Request ID	request_uid	String	Action Request Event Action Response Event File Content Detection Event	The unique identifier of the request. See specific usage.
Requested Permissions	requested_permissions	Integer Array	Memory Activity Event Process Activity Event Process Detection Event	The permissions that were requested by the process.
Requires Device	requires_device	Boolean	Common Vulnerabilities and Exposures (CVE) Object	True if there is a device associated with the CVE.
Resolution	resolution_id	Integer	Incident Closure Event	The incident resolution.
Resolutions	num_resolutions	Integer	Scan Event	The number of items that were resolved.
Resource	resource	String	AMSI Activity Event Boot Record Detection Event Process Detection Event	The target resource.
Resource Connection	resource_connection	Network Connection	Process Detection Event	The connection that was the target of suspicious or malicious activity by the event actor process.
Resource Directory	resource_directory	File	Process Detection Event	The directory that was the target of suspicious or malicious activity by the event actor process.
Resource File	resource_file	File	Process Detection Event	The file that was the target of suspicious or malicious activity by the event actor process.
Resource Identifier	resource_type_id	Integer	Process Detection Event	The identifier of the target of suspicious or malicious activity by the event actor process.
Resource Registry Key	resource_reg_key	Registry Key	Process Detection Event	The registry key that was the target of suspicious or malicious activity by the event actor process.
Resource Registry Value	resource_reg_value	Registry Value	Process Detection Event	The registry value that was the target of suspicious or malicious activity by the event actor process.
Resource Type	resource_type	String	Email URL Detection Event Process Detection Event	The context in which a resource was retrieved in a web request.
Response	response_id	Integer	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Print/FAX Content Detection Event	The response action taken.
Response Headers	response_headers	JSON	Email URL Detection Event Network Connection Object	The additional information associated with and HTTP response.
Responsible Actor	responsible_actor	Process	AMSI Activity Event API Activity Event Boot Record Detection Event Directory Activity Event Directory History Event File Activity Event File Detection Event File History Event Host Network Activity Event Host Network Detection Event Host Network History Event Host Network Traffic Activity Event Host Network Traffic Detection Event Kernel Activity Event Kernel Detection Event Memory Activity Event Memory Detection Event Module Activity Event Module Detection Event Monitored Source Event Peripheral Device Activity Event Peripheral Device Detection Event Peripheral Device History Event Process Activity Event Process Detection Event Process History Event Registry Key Activity Event Registry Key Detection Event Registry Value Activity Event Registry Value Detection Event Startup Application Configuration Change Event User Session Activity Event User Session Detection Event	The process that is responsible for triggering the detection. For Example: The untrusted ancestor process or the process that injected a thread into the actor process.
Restart Required	restart_required	Boolean	File Detection Event File Response Event Kernel Detection Event Memory Detection Event Module Detection Event Peripheral Device Detection Event Process Detection Event Process Response Event Registry Key Detection Event Registry Key Response Event Registry Value Detection Event Registry Value Response Event Startup App Response Event WMI Response Event	The device requires a restart in order to complete the disposition identified in the "id" field.
Return Value	retval	String	API Object	The return value of the API that is associated with the event or object.
Risk	risk_id	Integer	Threat Object	The cumulative risk rating of the threat as defined by the Foresight policy.
Risk	risk	Float	Common Vulnerability Scoring System V2 Object	The Common Vulnerability Scoring System (CVSS) calculated risk.
Rule Alert	rule_is_alertable	Boolean	Policy Object	Indicates whether the event should be considered for management server alerting.
Rule Category	rule_category_id	Integer	Policy Object	The category to which the rule belongs.
Rule Criteria Target	rule_criteria_target	String	Compliance Event	The target of the rule criteria.
Rule Description	rule_desc	String	Policy Object	The additional information that describes the rule.
Rule Group Description	rule_group_desc	String	Policy Object	The additional information that describes the group to which the rule belongs.
Rule Group ID	rule_group_uid	String	Policy Object	The unique identifier of the group to which the rule belongs.
Rule Group Name	rule_group_name	String	Policy Object	The name of the group to which the rule belongs.
Rule ID	rule_uid	String	Policy Object	The unique identifier of the rule that generated the event or was in effect when the event occurred.
Rule Name	rule_name	String	Incident Closure Event Incident Creation Event Incident Update Event Policy Object	The rule associated with the event. See specific usage.
Rules	rules	Rule Array	Policy Object	The additional rules that are associated with the policy.
Run Count	run_count	Integer	Prefetch Query Event	The prefetch file run count.
SHA-1	sha1	String	File Object Module Object	The SHA-1 checksum of the object content.
SHA-256	sha2	String	File Object Module Object	The SHA-256 checksum of the object content.
SMTP From	smtp_from	String	Email Object	The value of the SMTP MAIL FROM command.
SMTP Hello	smtp_hello	String	Email Object	The value of the SMTP HELO or EHLO command.
SMTP To	smtp_to	String Array	Email Object	The value of the SMTP envelope RCPT TO command.
SPF Status	spf_id	Integer	Email Authentication Object	The Sender Policy Framework (SPF) status of the email.
SSID	ssid	String	Network Information Object	The Service Set Identifier (SSID).
SSL Certificate	certificate	Certificate	Certificate Expiry Event Certificate Lifecycle Event	The certificate that pertains to the event.
STIC Control Data ID	stic_schema_id	String	Common Attributes	The telemetry submission control data identifier, represented as an 8 byte hexadecimal string.
STIC Enterprise IDs	stic_legacy_ent_uids	String Array	Common Attributes	The list of Enterprise IDs (related to license entitlement) that have been associated with the device.
STIC Hardware ID	stic_hw_uid	String	Common Attributes	The device hardware ID.
STIC Hardware IDs	stic_legacy_hw_uids	String Array	Common Attributes	The list of Hardware IDs that have been associated with the device.
STIC IP Hash	stic_ip_hash	String	Common Attributes	The STIC hash of the IP address.
STIC Machine ID	stic_uid	String	Common Attributes	The device Machine ID.
STIC Machine IDs	stic_legacy_uids	String Array	Common Attributes	The list of Machine IDs that have been associated with the device.
STIC PII	stic_has_pii	Boolean	Common Attributes	The indication of whether the event has any Personally Identifiable Information (PII).
STIC Version	stic_version	String	Common Attributes	The version of the STIC library.
Sandbox	sandbox_name	String	Process Object	The name of the containment jail (i.e., sandbox).
Scan Coverage Identifier	scan_coverage_id	Integer	Scan Event	Type of scan coverage.
Scan End	scan_end	Datetime	Compliance Scan Event File Content Detection Event Scan Event	The time that the scan ended. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Scan ID	scan_uid	String	AMSI Activity Event Administrative Group Query Event Boot Record Detection Event Compliance Event Compliance Scan Event DNS Query Event Directory Query Event Directory Remediation Event File Detection Event File Query Event File Remediation Event Host Network Detection Event Host Network Traffic Detection Event Job Query Event Job Remediation Event Kernel Detection Event Kernel Object Query Event Kernel Remediation Event Memory Detection Event Module Detection Event Module Query Event Module Remediation Event Network Information Query Event Network Query Event Network Remediation Event Peripheral Device Detection Event Peripheral Device Query Event Prefetch Query Event Process Detection Event Process Query Event Process Remediation Event Registry Key Detection Event Registry Key Query Event Registry Key Remediation Event Registry Value Detection Event Registry Value Query Event Registry Value Remediation Event Scan Event Service Query Event Service Remediation Event Startup Application Query Event Startup Application Remediation Event Unscannable File Event Unsuccessful Query Event Unsuccessful Remediation Event User Query Event User Session Detection Event User Session Query Event User Session Remediation Event	The unique identifier of the scan that is associated with the event.
Scan Name	scan_name	String	Compliance Scan Event File Content Detection Event Scan Event Unscannable File Event	The administrator-supplied or application-generated name of the scan. For example: "Home office weekly user database scan" "Scan folders for viruses" "Full system virus scan"
Scan Outcome	verdict_id	Integer	Scan Event	The outcome of the Scan.
Scan Start	scan_start	Datetime	Compliance Scan Event File Content Detection Event Scan Event	The time that the scan started. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Scan Type	scan_type	String	File Content Detection Event	The type of scan.
Scan Type	scan_type_id	Integer	Compliance Scan Event Scan Event	The type of scan.
Scanned Archives	num_archives	Integer	Scan Event	The number of archives scanned.
Scanned Files	num_files	Integer	Scan Event	The number of files scanned.
Scanned Folders	num_folders	Integer	Scan Event	The number of folders scanned.
Scanned Network Items	num_network	Integer	Scan Event	The number of network items scanned.
Scanned Processes	num_processes	Integer	Scan Event	The number of processes scanned.
Scanned Registry Items	num_registry	Integer	Scan Event	The number of registry items scanned.
Schedule ID	schedule_uid	String	Compliance Scan Event Scan Event	The unique identifier of the schedule that is associated with the event.
Scheme	scheme	String	Uniform Resource Locator (URL) Object	The scheme portion of the URL. For example: "http", "https", "ftp" or "sftp".
Score	score	Float	Common Vulnerabilities and Exposures (CVE) Object	A CVE score used for prioritizing the severity of the vulnerability.
Security Descriptor	security_descriptor	String	File Object Module Object Registry Key Object	The object security descriptor.
Security ID	sid	String	User Object	The user security identifier (SID). The SID is a unique value of variable length used to identify a trustee. Each user account has a SID issued by an authority, such as a Windows domain controller, and stored in a security database.
Security Level	curr_security_level_id	Integer	Entity Change Event	The current security level of the entity.
Security States	curr_security_state_ids	Integer Array	Entity Change Event	The current security states of the entity.
Sender Email	sender_email	String	File Content Detection Event	The email address of the sender.
Sender Host Name	sender_host	String	Email Detection Event	The host name of the sending email server.
Sender IP Address	sender_ip	IP Address	Action Request Event Email Object	The IP address of the sender, in either IPv4 or IPv6 format.
Sequence Number	seq_num	Integer	Common Attributes	A 32-bit positive number that indicates the order of events sent by the client. Note: The first event that a client sends has a Sequence Number of 1 and the client increments the Sequence Number with each subsequent event. For UNPACK (2) composite events, each event in the events array must have a unique seq_num, such as events[i+1].seq_num = events[i].seq_num + 1. When the sequence number wraps around, based on java.lang.Integer.MAX_VALUE, it must start from 1. The event service records sequence numbers to detect lost events.
Serial Number	serial	String	Certificate Object Peripheral Device Object	The serial number that pertains to the object. See specific usage.
Server Certificate	server_certificate	Certificate	Transport Layer Security Object	Server certificate details.
Service	service	Service	ICAP Request Modification Object ICAP Response Modification Object Service Query Event Service Remediation Event	The service that pertains to the object.
Session	session	Session	Process Object User Session Activity Event User Session Detection Event User Session Query Event User Session Remediation Event	The user session that pertains to the event.
Session ID	session_id	Integer	Policy Override Audit Event Process Object	The ID of the user session that pertains to the event or object, as reported by the OS.
Session ID	session_uid	String	User Session Audit Event	The unique ID of the user session that pertains to the event.
Sessions	sessions	Session Array	Common Attributes	The user sessions on the device.
Severity	severity_id	Integer	Common Attributes Common Vulnerabilities and Exposures (CVE) Object	The severity of the event.
Shell	shell	String	User Object	The user's login shell.
Signature Bits	signature_value	Long	File Object Module Object	The digital signature bitmask.
Signature Company Name	signature_company_name	String	File Object Module Object	The company name on the certificate that signed the file.
Signature Created Date	signature_created_date	Datetime	File Object Module Object	The date and time when the signature was created. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Signature Developer ID	signature_developer_uid	String	File Object Module Object	The developer ID on the certificate that signed the file.
Signature Fingerprints	signature_fingerprints	Fingerprint Array	File Object Module Object	The array of fingerprint objects associated with the certificate.
Signature Issuer	signature_issuer	String	File Object Module Object	The issuer of the object signature.
Signature Level	signature_level_id	Integer	File Object Module Object	A numeric representation of the signature level. The signature levels are defined by STAR.
Signature Serial Number	signature_serial_number	String	File Object Module Object	The object serial number.
Signature Statuses	signature_statuses	String Array	Certificate Object	The array of signature statuses. Note: The first element of the array is the result of validating server SSL certificate, the second of which contains the errors observed in the server certificate.
Signature Value IDs	signature_value_ids	Integer Array	File Object Module Object	The array of signature values as derived from the Signature Bits.
Size	size	Long	Email Object File Object Module Object	The size of the object, in bytes.
Skipped	num_skipped	Integer	Scan Event	The number of skipped items.
Source	source	Event Source	Common Attributes	The monitored source that originated the event.
Source Event ID	ref_event	Integer	Monitored Source Event	The event source's event id.
Source Event Name	ref_event_name	String	Monitored Source Event	The event source's event name.
Source IP	src_ip	IP Address	File Object Module Object Network Connection Object	The source device IP address that pertains to the event or object. The format is either IPv4 or IPv6.
Source Location	src_location	Location	Network Connection Object	The location associated with the client IP address.
Source MAC	src_mac	String	Network Connection Object	The MAC address of the device that initiated the network connection.
Source Name	src_name	String	File Object Module Object Network Connection Object	The host name of the source device that pertains to the event or object.
Source Port	src_port	Integer	Network Connection Object	The port number of the source device.
Source Service	src_service	String	Network Connection Object	The source network connection service name.
Stack Trace	status_stack_trace	String	Common Attributes	The list of calls that the application was making when an exception was thrown.
Start Time	start_time	Datetime	Certificate Object Email Analytics Event License Information Object Process Object	The start time that pertains to the event or object. See specific usage. Note: The time submission format is the number of milliseconds since 01/01/1970 00:00:00 UTC.
Start Type	start_id	Integer	Service Object Startup Application Object	The start type of the service or startup application.
Startup Application	startup_app	Startup App	Startup App Response Event Startup Application Configuration Change Event Startup Application Query Event Startup Application Remediation Event	The startup application that pertains to the event.
State	state_id	Integer	Incident Closure Event Incident Creation Event Incident Update Event Network Query Event	The state of the event or object. See specific usage.
State	run_state_id	Integer	Job Object Service Object Startup Application Object	The state of the job or service. See specific usage.
States	state_ids	Integer Array	Policy Object	The states that are related to the policy.
Status	status_id	Integer	Common Attributes	The cross-platform event status.
Status	status	String	ICAP Request Modification Object ICAP Response Modification Object	Request or Response Status.
Status Details	status_detail	String	Common Attributes ICAP Request Modification Object ICAP Response Modification Object	The status details.
Sub-feature Name	subfeature_name	String	Common Attributes	The name of the sub-feature originating the event.
Sub-technique ID	sub_technique_uid	String	Attack Object	The unique identifier of the attack sub-technique, as defined by ATT&CK Matrix^TM.
Sub-technique Name	sub_technique_name	String	Attack Object	The name of the attack sub-technique, as defined by ATT&CK Matrix^TM.
Subject	header_subject	String	Email Object	The email header Subject value, as defined by RFC 5322.
Subject City	subject_city	String	Certificate Object	The certificate subject city.
Subject Country	subject_country	String	Certificate Object	The certificate subject country.
Subject Email	subject_email	String	Certificate Object	The certificate subject email.
Subject Name	subject_name	String	Certificate Object	The certificate subject name.
Subject Org Unit	subject_org_unit	String	Certificate Object	The certificate subject organizational unit.
Subject Organization	subject_organization	String	Certificate Object	The certificate subject organization.
Subject State	subject_state	String	Certificate Object	The certificate subject state.
Subject Street	subject_street	String	Certificate Object	The certificate subject street.
Subnet ID	subnet_uid	String	Cloud Hosted VM Object	The unique identifier of the virtual subnet.
Subtype	subtype	String	File Content Type Object	The specific format for the type of data.
Subtype Identifiers	subtype_ids	Integer Array	Service Object Startup Application Object	The sub type identification number.
Subtype Names	subtypes	String Array	Service Object Startup Application Object	The specific format for the type of data.
Summary	summary	String	Incident Creation Event Incident Update Event	The summary for generation of the event.
Suspected Breach	suspected_breach	Boolean	Incident Creation Event Incident Update Event	The indication of whether a breach is suspected.
System	is_system	Boolean	File Object Kernel Resource Object Module Object Registry Key Object Registry Value Object	The indication of whether the object is part of the operating system.
System Activity	activity_id	Integer	File Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Peripheral Device Detection Event Process Detection Event Registry Key Detection Event Registry Value Detection Event	The related system activity.
System CPU	cpu_system	Long	CPU Usage Event	System CPU.
System Call	system_call	String	Kernel Resource Object	The system call that was invoked.
TCP Flags	tcp_flags	Integer	Network Connection Object	The network connection TCP header flags (i.e., control bits).
TLS	tls	TLS	Email Delivery Event Network Connection Object	The Transport Layer Security (TLS) attributes.
TLS Policy	tls_policy_id	Integer	Transport Layer Security Object	The Transport Layer Security (TLS) policy.
Tactics	tactic_uids	String Array	Attack Object	The tactics that are associated with the attack technique, as defined by ATT&CK Matrix^TM.
Tactics	tactic_ids	Integer Array	Attack Object	The tactics that are associated with the attack technique (To be deprecated, use tactic_uids).
Target	target	JSON	Action Request Event	The target is the object of the Action.
Target Name	target_name	String	Action Request Event	The target name.
Technique ID	technique_uid	String	Attack Object	The unique identifier of the attack technique, as defined by ATT&CK Matrix^TM. For example: T1189.
Technique Name	technique_name	String	Attack Object	The name of the attack technique, as defined by ATT&CK Matrix^TM. For example: Drive-by Compromise.
Thread ID	tid	Integer	Process Object	The Identifier of the thread associated with the event, as returned by the operating system.
Thread Name	status_thread_name	String	Common Attributes	The name of the thread that pertains to the status.
Threat	threat	Threat	Boot Record Detection Event Email Detection Event Email File Detection Event Email URL Detection Event File Detection Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Network Detection Event Peripheral Device Detection Event Process Detection Event Registry Key Detection Event Registry Value Detection Event User Session Detection Event	The primary threat identified by the event. Note: The primary threat may be the first threat found by the detection engine, or it may be the most severe threat found. The client determines the primary threat.
Threat Sub ID	sub_id	Integer	Threat Object	The threat sub identifier as reported by the detection engine. Note: Pertains only to IPS threats.
Threats	threats	Threat Array	Boot Record Detection Event File Detection Event Host Network Detection Event Host Network Traffic Detection Event Kernel Detection Event Memory Detection Event Module Detection Event Peripheral Device Detection Event Process Detection Event Registry Key Detection Event Registry Value Detection Event User Session Detection Event	The additional threats that were detected.
Time Zone	timezone	Integer	Common Attributes	Returns a Long value that represents the difference in minutes of between the local time in this time zone and the Coordinated Universal Time (UTC). Ex: In a state adopting daylight time in the Pacific time zone, the Bias is 480 minutes and DaylightBias is -60 minutes. To determine the time in UTC for June 11, 2 A.M. PST, add a Bias of (480/60) hours and a DaylightBias of -(60/60) hours to the local time June 11, 2 A.M. The time in UTC is June 11, 9 A.M.
Title	title	String	Common Vulnerabilities and Exposures (CVE) Object	The title associated with the CVE.
To	header_to	String Array	Email Object	The email header To values, as defined by RFC 5322.
Top Attacked	top_attacked	JSON Array	Email Analytics Event	The top 20 email accounts in your organization who were intended recipients of malicious emails during the report period.
Total	total	Integer	License Count Event Scan Event	The total number of items. See specific usage.
Transaction ID	transaction_uid	String	File Content Detection Event	The unique identifier of the transaction.
Trusted	num_trusted	Integer	Scan Event	The number of trusted items.
Trusted Device	device_is_trusted	Boolean	Common Attributes	The event occurred on a trusted device.
Type	type_id	Integer	Common Attributes Compliance Rule Object Event Source Object File Object File Content Type Object Kernel Resource Object License Information Object Module Object Network Information Object Policy Object Registry Value Object Threat Object	The type of the object or event. See specific usage.
Type String	type	String	Common Attributes Managed Entity Object Printer Object Registry Value Object	The type of the event, object, or value. See specific usage.
Types	type_ids	Integer Array	Service Object Startup Application Object	The service type identifiers.
URL	url	Uniform Resource Locator	Email URL Activity Event Email URL Detection Event File Object Module Object Network Connection Object URL Reputation Event	The URL object that pertains to the event or object. See specific usage.
URL Text	text	String	Uniform Resource Locator (URL) Object	THE URL text string.
URLs	urls	Uniform Resource Locator Array	Cyber Observable eXpression Object	The URLs that pertain to the event. See specific usage.
Unmanaged Device	device_is_unmanaged	Boolean	Common Attributes	The event occurred on an unmanaged device.
Unresolved	num_unresolved	Integer	Scan Event	The number of scanned itmes with threats, but no resolution.
Upload Bytes	bytes_upload	Long	Network Connection Object	The number of bytes uploaded from the source to the destination.
Used	is_used	Boolean	Transport Layer Security Object	The indication of whether the TLS is used.
Used	used	Integer	License Count Event	The number of items used.
User	user	User	Common Attributes Job Object Process Object User Session Object	The user that pertains to the event or object. See specific usage.
User Activity	activity	String	File Content Detection Event	The user activity related to the event.
User CPU	cpu_user	Long	CPU Usage Event	User CPU.
User ID	user_uid	String	Common Attributes	The unique identifier of the user associated with the event.
User Name	user_name	String	Common Attributes	The name of the user that originated or caused the event (if the event involves a user) or the user on whose behalf the event occurred.
User Present	is_user_present	Boolean	Common Attributes	The indication of whether the user was logged on at event generation time.
Users	users	User Array	Administrative Group Query Event	The users that belong to the administrative group.
VPC ID	vpc_uid	String	Cloud Hosted VM Object	The unique identifier of the Virtual Private Cloud (VPC).
Valid	is_valid	Boolean	Certificate Object	The indication of whether the certificate is valid.
Value	value	String	Fingerprint Object	The value that pertains to the object. See specific usage.
Vendor	vendor	String	Peripheral Device Object Service Object Startup Application Object	The vendor that pertains to the object. See specific usage.
Version	version	String	Certificate Object Common Attributes File Object Managed Entity Object Module Object Policy Object Transport Layer Security Object	The version that pertains to the event or object. See specific usage.
Violations	num_violations	Integer	Clipboard Content Detection Event Content Detection Event Email Content Detection Event File Content Detection Event Instant Message Content Detection Event Print/FAX Content Detection Event Rule Object	The number of times the policy or rule was violated.
Volume ID	volume_uid	String	BitLocker Event	The unique identifier of the volume.
WMI Instance	wmi_instance	WMI Instance	WMI Response Event	The WMI instance that pertains to the event.