Use these Omnissa Trust Network data definitions to help you analyze widgets in dashboards, to create reports, and to create workflows in Omnissa Intelligence.
BETTER Mobile
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Agent Address | The agent address. | agent_address |
| Agent DNS Domain | The agent DNS domain. | agent_dns_domain |
| Agent Host Name | The agent host name. | agent_host_name |
| Agent ID | The agent ID. | agent_id |
| Agent MAC Address | The agent MAC address. | agent_mac_address |
| Agent NT Domain | The agent NT domain. | agent_nt_domain |
| Agent Receipt Time | The agent receipt time. | agent_receipt_time |
| Agent Time Zone | The agent time zone. | agent_time_zone |
| Agent Translated Address | The agent translated address. | agent_translated_address |
| Agent Translated Zone External ID | The agents translated zone external ID. | agent_translated_zone_external_id |
| Agent Translated Zone URI | The agent translated zone URI. | agent_translated_zone_uri |
| Agent Type | The type of agent. | agent_type |
| Agent Version | The version of the agent. | agent_version |
| Agent Zone External ID | The agent zone external ID. | agent_zone_external_id |
| Agent Zone URI | The agent zone URI. | agent_zone_uri |
| App Name | The name of the app. | appname |
| A.pplication Protocol | The application protocol. | application_protocol |
| Base Event Count | The base event count. | base_event_count |
| Bytes In | The bytes in. | bytes_in |
| Bytes Out | The bytes out. | bytes_out |
| CEF Date Prefix | The date prefix before the common event format header. | cef_date_prefix |
| CEF Event ID | A unique ID assigned by ArcSight. | cef_event_id |
| CEF Host Prefix | The host prefix of the common event format. | cef_host_prefix |
| Customer External ID | The customer's external ID. | customer_external_id |
| Customer URI | The customer's URI. | customer_uri |
| Destination Address | The destination address. | destination_address |
| Destination DNS Domain | The destination DNS domain. | destination_dns_domain |
| Destination GEO Latitude | The destination GEO latitude. | destination_geo_latitude |
| Destination GEO Longitude | The destination GEO longitude. | destination_geo_longitude |
| Destination Host Name | The destination host name. | destination_host_name |
| Destination MAC Address | The destination MAC address. | destination_mac_address |
| Destination NT Domain | The destination NT domain. | destination_nt_domain |
| Destination Port | The dstination port. | destination_port |
| Destination Process ID | The destination process ID. | destination_process_id |
| Destination Process Name | The destination process name. | destination_process_name |
| Destination Service Name | The destination service name. | destination_service_name |
| Destination Translated Address | The destination translated address. | destination_translated_address |
| Destination Translated Port | The destination translated port. | destination_translated_port |
| Destination Translated Zone External ID | The destination translated zone external ID. | destination_translated_zone_external_id |
| Destination Translated Zone URI | The destination translated zone URI. | destination_translated_zone_uri |
| Destination User ID | The destination user ID. | destination_user_id |
| Destination User Name | The destination user name. | destination_user_name |
| Destination User Privileges | The destination user privileges. | destination_user_privileges |
| Destination Zone External ID | The destination zone external ID. | destination_zone_external_id |
| Destination Zone URI | The destination zone URI. | destination_zone_uri |
| Device Action | The device action. | device_action |
| Device Address | The device address. | device_address |
| Device Custom Date 1 | The device custom date 1. | device_custom_date_1 |
| Device Custom Date 2 | The device custom date 2. | device_custom_date_2 |
| Device Custom Floating Point 1 | The device custom floating point 1. | device_custom_floating_point_1 |
| Device Custom Floating Point 2 | The device custom floating point 2. | device_custom_floating_point_2 |
| Device Custom Floating Point 3 | The device custom floating point 3. | device_custom_floating_point_3 |
| Device Custom Floating Point 4 | The device custom floating point 4. | device_custom_floating_point_4 |
| Device Custom IPV6 Address 1 | The device custom IPV6 address 1. | device_custom_ipv6_address_1 |
| Device Custom IPV6 Address 3 | The device custom IPV6 address 3. | device_custom_ipv6_address_3 |
| Device Custom IPV6 Address 4 | The device custom IPV6 address 4. | device_custom_ipv6_address_4 |
| Device Custom Number 1 | The device custom number 1. | device_custom_number_1 |
| Device Custom Number 2 | The device custom number 2. | device_custom_number_2 |
| Device Custom Number 3 | The device custom number 3. | device_custom_number_3 |
| Device Custom String 1 | The device custom string 1. | device_custom_string_1 |
| Device Custom String 2 | The device custom string 2. | device_custom_string_2 |
| Device Custom String 3 | The device custom string 3. | device_custom_string_3 |
| Device Custom String 4 | The device custom string 4. | device_custom_string_4 |
| Device Custom String 5 | The device custom string 5. | device_custom_string_5 |
| Device Custom String 6 | The device custom string 6. | device_custom_string_6 |
| Device Direction | The device direction. | device_direction |
| Device DNS Domain | The device's DNS domain. | device_dns_domain |
| Device Event category | The device event category. | device_event_category |
| Device Event Class ID | The device event class ID. | device_event_class_id |
| Device External ID | The device external ID. | device_external_id |
| Device facility | The device facility. | device_facility |
| Device Host Name | The device host name. | device_host_name |
| Device Inbound Interface | The device inbound interface. | device_inbound_interface |
| Device MAC Address | The device's MAC address. | device_mac_address |
| Device NT Domain | The device's NT domain. | device_nt_domain |
| Device Outbound Interface | The device outbound interface. | device_outbound_interface |
| Device Payload ID | The device payload ID. | device_payload_id |
| Device Process ID | The device process ID. | device_process_id |
| Device Process Name | The device process name. | device_process_name |
| Device Product | The device product. | device_product |
| Device Receipt Time | The device receipt time. | device_receipt_time |
| Device Time Zone | The device time zone. | device_time_zone |
| Device Translated Address | The device translated address. | device_translated_address |
| Device Translated Zone External ID | The device translated zone external ID. | device_translated_zone_external_id |
| Device Translated Zone URI | The device translated zone URI. | device_translated_zone_uri |
| Device Vendor | The device vendor. | device_vendor |
| Device Version | The device version. | device_version |
| Device Zone External ID | The device zone external ID. | device_zone_external_id |
| Device Zone URI | The device zone URI. | device_zone_uri |
| End Time | The end time of an event, process, or period that marks completion or duration. | end_time |
| Event Name | The event name. | name |
| Event Outcome | The event outcome. | event_outcome |
| External ID | The external ID. | external_id |
| Facility | The facility. | facility |
| File Create Time | The file create time. | file_create_time |
| File Hash | The file hash. | file_hash |
| File ID | The file ID. | file_id |
| File Modification Time | The file modification time. | file_modification_time |
| File Name | The file name. | file_name |
| File Path | The file path. | file_path |
| File Permission | The file permission. | file_permission |
| File Size | The file size. | file_size |
| File Type | The file type. | file_type |
| Flex Date 1 | The flex date 1. | flex_date_1 |
| Flex String 1 | The flex string 1. | flex_string_1 |
| Flex String 2 | The flex string 2. | flex_string_2 |
| Level | The level. | level |
| Message | An arbitrary message that provides more details about events. | msg |
| Message ID | The message ID. | message_id |
| Message Type | The message type. | message_type |
| OS Version | The version of the operating system. | osversion |
| Old File Create Time | The old file create time. | old_file_create_time |
| Old File Hash | The old file hash. | old_file_hash |
| Old File ID | The old file ID. | old_file_id |
| Old File Modification Time | The old file modification time. | old_file_modification_time |
| Old File Name | The old file name. | old_file_name |
| Old File Path | The old file path. | old_file_path |
| Old File Permission | The old file permission. | old_file_permission |
| Old File Size | The old file size. | old_file_size |
| Old File Type | The old file type. | old_file_type |
| Partner Name | The partner name. | partner_name |
| Platform | The platform of the object. | platform |
| Process ID | The process ID. | process_id |
| Raw Event | The raw event. | raw_event |
| Reason | The rationale for addressing a threat. | reason |
| Remote Address | The remote address. | remote_address |
| Request Client Application | The request client application. | request_client_application |
| Request Context | The request context. | request_context |
| Request Cookies | The request cookies. | request_cookies |
| Request Method | The request method. | request_method |
| Request URL | The request URL. | request_url |
| Severity | The severity. | severity |
| Source Address | The source address. | source_address |
| Source DNS Domain | The source DNS domain. | source_dns_domain |
| Source GEO Latitude | The source GEO latitude. | source_geo_latitude |
| Source GEO Longitude | The source GEO longitude. | source_geo_longitude |
| Source Host Name | The source host name. | source_host_name |
| Source MAC Address | The source MAC address. | source_mac_address |
| Source NT Domain | The source NT domain. | source_nt_domain |
| Source PORT | The source port. | source_port |
| Source Process ID | The source process ID. | source_process_id |
| Source Process Name | The source process name. | source_process_name |
| Source Service Name | The source service name. | source_service_name |
| Source Translated Address | The source translated address. | source_translated_address |
| Source Translated Port | The source translated port. | source_translated_port |
| Source Translated Zone External ID | The source translated zone external ID. | source_translated_zone_external_id |
| Source Translated Zone URI | The source translated zone URI. | source_translated_zone_uri |
| Source User ID | The source user ID. | source_user_id |
| Source User Name | The source user name. | source_user_name |
| Source User Privileges | The source user privileges. | source_user_privileges |
| Source Zone External ID | The source zone external ID. | source_zone_external_id |
| Source Zone URI | The source zone URI. | source_zone_uri |
| Start Time | The start time the event, process, or period. | start_time |
| Structure Data | The structure data. | structure_data |
| Timestamp | The timestamp of an event or process. | timestamp |
| Transport Protocol | The transport protocol. | transport_protocol |
| Type | Lists the type of threat. | type |
Carbon Black
Ingested data that is displayed in the Intelligence Console
This listed data is ingested from Carbon Black in to Intelligence and displayed in the Intelligence console.
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Carbon Black CB Defense Event ID | Represents a unique identifier for an event, as reported by Carbon Black. | threatinfo_threatcause_causeeventid |
| Carbon Black Device Email | Lists the email address used to register a device in the Carbon Black Defense console. | deviceinfo_email |
| Carbon Black Device ID | Unique device identifier in the Carbon Black database. | deviceinfo_deviceid |
| Carbon Black Device Name | The device name as shown in the Carbon Black console. | deviceinfo_devicename |
| Carbon Black Event Description | The description of a threat event as reported by Carbon Black. | eventdescription |
| Carbon Black External IP Address | Lists the external IP address of a device, as reported by Carbon Black. | deviceinfo_externalipaddress |
| Carbon Black Group Name | Lists the name of a device group in Carbon Black Defense console. | deviceinfo_groupname |
| Carbon Black Incident ID | Unique identification for each incident generated by Carbon Black. | threatinfo_incidentid |
| Carbon Black Internal IP Address | Lists the internal IP address of a device, as reported by Carbon Black. | deviceinfo_internalipaddress |
| Carbon Black Main Process Hash (SHA256) | Lists the hash/signature of the process causing a threat event, as reported by Carbon Black. | threatinfo_threatcause_actor |
| Carbon Black Main Process Reputation | The reputation of the process, as reported by Carbon Black. | threatinfo_threatcause_reputation |
| Carbon Black Origin Source | The source of the threat, as reported by Carbon Black. | threatinfo_threatcause_originsourcetype |
| Carbon Black Rule Name | Lists the unique name used to identify a rule in the Carbon Black defense console. | rulename |
| Carbon Black Severity Score | A numbered score used by Carbon Black as a way to represent the severity of a threat event. | threatinfo_score |
| Carbon Black Threat Name | Lists the name used to identify a threat, as reported by Carbon Black. | threatinfo_threatcause_actorname |
| Carbon Black Threat Reason | The reason of the threat, as reported by Carbon Black. | threatinfo_threatcause_reason |
| Carbon Black Threat Summary | The summary of a threat event as reported by Carbon Black. | threatinfo_summary |
| Link to CB Defense Alert | Provides a link to the threat details within Carbon Black Defense console. | url |
Ingested data that is not displayed in the Intelligence Console
This listed data is ingested from Carbon Black in to Intelligence but it is not displayed in the Intelligence console.
| Carbon Black Raw Data Names | Definitions |
|---|---|
| deviceinfo_devicetype | Lists the manufacturer or type of device as reported by Carbon Black. |
| deviceinfo_deviceversion | Lists the OS version of a device as reported by Carbon Black. |
| deviceinfo_targetprioritycode | Lists the numerical priority of the device (defined when installing the sensor on the device), as reported by Carbon Black. |
| deviceinfo_targetprioritytype | Lists the priority of the device (defined as Low, Medium, or High when installing the sensor on the device), as reported by Carbon Black. |
| deviceinfo_uemid | Lists a device unique identifier which Carbon Black reports with every threat event and is required for device correlation in Intelligence. |
| eventtime | Time at which a threat event occurred, as reported by Carbon Black . |
| threatinfo_indicators | Lists the threat indicators, as reported by Carbon Black. |
| threatinfo_threatcause_actorprocessppid | The Process ID of the offending process, as reported by Carbon Black. |
| threatinfo_threatcause_threatcategory | The category of the threat, as reported by Carbon Black. |
| threatinfo_time | Indicates the time at which Carbon Black generated threat information. |
| type | Lists the type of threat, as reported by Carbon Black. |
Check Point
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Agent Address | The agent address. | agent_address |
| Agent DNS Domain | The agent DNS domain. | agent_dns_domain |
| Agent Host Name | The agent host name. | agent_host_name |
| Agent ID | The agent ID. | agent_id |
| Agent MAC Address | The agent MAC address. | agent_mac_address |
| Agent NT Domain | The agent NT domain. | agent_nt_domain |
| Agent Receipt Time | The agent receipt time. | agent_receipt_time |
| Agent Time Zone | The agent time zone. | agent_time_zone |
| Agent Translated Address | The agent translated address. | agent_translated_address |
| Agent Translated Zone External ID | The agent translated zone external ID. | agent_translated_zone_external_id |
| Agent Translated Zone URI | The agent translated zone URI. | agent_translated_zone_uri |
| Agent Type | The agent type. | agent_type |
| Agent Version | The agent version. | agent_version |
| Agent Zone External ID | The agent zone external ID. | agent_zone_external_id |
| Agent Zone URI | The agent zone URI. | agent_zone_uri |
| Application Protocol | The application protocol. | application_protocol |
| Base Event Count | The base event count. | base_event_count |
| Bytes In | The bytes in. | bytes_in |
| Bytes Out | The bytes out. | bytes_out |
| CEF Date Prefix | The common event format date prefix. | cef_date_prefix |
| CEF Event ID | The unique ID assigned by ArcSight. | cef_event_id |
| CEF Host Prefix | The common event format host prefix. | cef_host_prefix |
| Customer External ID | The customer external ID. | customer_external_id |
| Customer URI | The customer URI. | customer_uri |
| Destination Address | The destination address. | destination_address |
| Destination DNS Domain | The destination DNS domain. | destination_dns_domain |
| Destination GEO Latitude | The destination GEO latitude. | destination_geo_latitude |
| Destination GEO Longitude | The destination GEO longitude. | destination_geo_longitude |
| Destination Host Name | The destination host name. | destination_host_name |
| Destination MAC Address | The destination MAC address. | destination_mac_address |
| Destination NT Domain | The destination NT domain. | destination_nt_domain |
| Destination Port | The destination port. | destination_port |
| Destination Process ID | The destination process ID. | destination_process_id |
| Destination Process Name | The destination process name. | destination_process_name |
| Destination Service Name | The destination service name. | destination_service_name |
| Destination Translated Address | The destination translated address. | destination_translated_address |
| Destination Translated Port | The destination translated port. | destination_translated_port |
| Destination Translated Zone External ID | The destination translated zone external ID. | destination_translated_zone_external_id |
| Destination Translated Zone URI | The destination translated zone URI. | destination_translated_zone_uri |
| Destination User ID | The destination user ID. | destination_user_id |
| Destination User Name | The destination user name. | destination_user_name |
| Destination User Privileges | The destination user privileges. | destination_user_privileges |
| Destination Zone External ID | The destination zone external ID. | destination_zone_external_id |
| Destination Zone URI | The destination zone URI. | destination_zone_uri |
| Device Action | The device action. | device_action |
| Device Address | The device address. | device_address |
| Device Custom Date 1 | The device custom date 1. | device_custom_date_1 |
| Device Custom Date 2 | The device custom date 2. | device_custom_date_2 |
| Device Custom Floating Point 1 | The device custom floating point 1. | device_custom_floating_point_1 |
| Device Custom Floating Point 2 | The device custom floating point 2. | device_custom_floating_point_2 |
| Device Custom Floating Point 3 | The device custom floating point 3. | device_custom_floating_point_3 |
| Device Custom Floating Point 4 | The device custom floating point 4. | device_custom_floating_point_4 |
| Device Custom IPV6 Address 1 | The device custom IPV6 address 1. | device_custom_ipv6_address_1 |
| Device Custom IPV6 Address 3 | The device custom IPV6 address 3. | device_custom_ipv6_address_3 |
| Device Custom IPV6 Address 4 | The device custom IPV6 address 4. | device_custom_ipv6_address_4 |
| Device Custom Number 1 | The device custom number 1. | device_custom_number_1 |
| Device Custom Number 2 | The device custom number 2. | device_custom_number_2 |
| Device Custom Number 3 | The device custom number 3. | device_custom_number_3 |
| Device Custom String 1 | The device custom string 1. | device_custom_string_1 |
| Device Custom String 2 | The device custom string 2. | device_custom_string_2 |
| Device Custom String 3 | The device custom string 3. | device_custom_string_3 |
| Device Custom String 4 | The device custom string 4. | device_custom_string_4 |
| Device Custom String 5 | The device custom string 5. | device_custom_string_5 |
| Device Custom String 6 | The device custom string 6. | device_custom_string_6 |
| Device Direction | The device direction. | device_direction |
| Device DNS Domain | The device DNS domain. | device_dns_domain |
| Device Event category | The device event category. | device_event_category |
| Device Event Class ID | The device event class ID. | device_event_class_id |
| Device External ID | The device external ID. | device_external_id |
| Device facility | The device facility. | device_facility |
| Device Host Name | The device host name. | device_host_name |
| Device Inbound Interface | The device inbound interface. | device_inbound_interface |
| Device MAC Address | The device MAC address. | device_mac_address |
| Device NT Domain | The device NT domain. | device_nt_domain |
| Device Outbound Interface | The device outbound interface. | device_outbound_interface |
| Device Payload ID | The device payload ID. | device_payload_id |
| Device Process ID | The device process ID. | device_process_id |
| Device Process Name | The device process name. | device_process_name |
| Device Product | The device product. | device_product |
| Device Receipt Time | The device receipt time. | device_receipt_time |
| Device Time Zone | The device time zone. | device_time_zone |
| Device Translated Address | The device translated address. | device_translated_address |
| Device Translated Zone External ID | The device translated zone external ID. | device_translated_zone_external_id |
| Device Translated Zone URI | The device translated zone URI. | device_translated_zone_uri |
| Device Type | The type of device. | devicetype |
| Device Vendor | The device vendor. | device_vendor |
| Device Version | The device version. | device_version |
| Device Zone External ID | The device zone external ID. | device_zone_external_id |
| Device Zone URI | The device zone URI | device_zone_uri |
| End Time | The end time of an event, process, or period that marks completion or duration. | end_time |
| Event Name | The event name. | name |
| Event Outcome | The event outcome. | event_outcome |
| External ID | The external ID. | external_id |
| Facility | The facility. | facility |
| File Create Time | The file create time. | file_create_time |
| File Hash | The file hash. | file_hash |
| File ID | The file ID. | file_id |
| File Modification Time | The file modification time. | file_modification_time |
| File Name | The file name. | file_name |
| File Path | The file path. | file_path |
| File Permission | The file permission. | file_permission |
| File Size | The file size. | file_size |
| File Type | The file type. | file_type |
| Flex Date 1 | The flex date 1. | flex_date_1 |
| Flex String 1 | The flex string 1. | flex_string_1 |
| Flex String 2 | The flex string 2. | flex_string_2 |
| Level | The level. | level |
| Message | An arbitrary message that provides more details about events. | msg |
| Message ID | The message ID. | message_id |
| Message Type | The message type. | message_type |
| Old File Create Time | The old file create time. | old_file_create_time |
| Old File Hash | The old file hash. | old_file_hash |
| Old File ID | The old file id. | old_file_id |
| Old File Modification Time | The old file modification time. | old_file_modification_time |
| Old File Name | The old file name. | old_file_name |
| Old File Path | The old file path. | old_file_path |
| Old File Permission | The old file permission. | old_file_permission |
| Old File Size | The old file size. | old_file_size |
| Old File Type | The old file type. | old_file_type |
| Partner Device Identifier | The partner device identifier. | partner_device_identifier |
| Partner Name | The partner name. | partner_name |
| Process ID | The process ID. | process_id |
| Raw Event | The raw event. | raw_event |
| Reason | The rationale for addressing a threat. | reason |
| Remote Address | The remote address. | remote_address |
| Request Client Application | The request client application. | request_client_application |
| Request Context | The request context. | request_context |
| Request Cookies | The request cookies. | request_cookies |
| Request Method | The request method. | request_method |
| Request URL | The request URL. | request_url |
| Severity | The severity. | severity |
| Source Address | The source address. | source_address |
| Source DNS Domain | The source DNS domain. | source_dns_domain |
| Source GEO Latitude | The source GEO latitude. | source_geo_latitude |
| Source GEO Longitude | The source GEO longitude. | source_geo_longitude |
| Source Host Name | The source host name. | source_host_name |
| Source MAC Address | The source MAC address. | source_mac_address |
| Source NT Domain | The source NT domain. | source_nt_domain |
| Source PORT | The source port. | source_port |
| Source Process ID | The source process ID. | source_process_id |
| Source Process Name | The source process name. | source_process_name |
| Source Service Name | The source service name. | source_service_name |
| Source Translated Address | The source translated address. | source_translated_address |
| Source Translated Port | The source translated port. | source_translated_port |
| Source Translated Zone External ID | The source translated zone external ID. | source_translated_zone_external_id |
| Source Translated Zone URI | The source translated zone URI. | source_translated_zone_uri |
| Source User ID | The source user ID. | source_user_id |
| Source User Name | The source user name. | source_user_name |
| Source User Privileges | The source user privileges. | source_user_privileges |
| Source Zone External ID | The source zone external ID. | source_zone_external_id |
| Source Zone URI | The source zone URI. | source_zone_uri |
| Start Time | The start time of the event, process, or period. | start_time |
| Structure Data | The structure data. | structure_data |
| Transport Protocol | The transport protocol. | transport_protocol |
| Type | Lists the type of threat. | type |
Lookout for Work
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Actor ID | The actor ID perpetrating the threat. | actor_id |
| Actor Type | The actor type perpetrating the threat. | actor_type |
| App Name | The app name. | details_applicationname |
| App Package Name | The app package name. | details_packagename |
| Changed Type | The type of modification or alteration to an object. | changetype |
| Customer Device ID | A number identifying a customer device. | target_customerdeviceid |
| Device Activation Status | The device activation status. | details_activationstatus |
| Device Email | The device email. | target_emailaddress |
| Device Manufacturer | The device manufacturer. | target_manufacturer |
| Device Model | The device model. | target_model |
| Device Organization Group ID | A number identifying an organization group. | info_devicegroupids |
| Device Security Status | The device security status. | details_securitystatus |
| Event Time | The time an event occurred. | eventtime |
| File Name | The file name. | details_filename |
| File Path | The file path. | details_path |
| IP Address | The details of the IP address. | details_dnsipaddresses |
| Lookout Event Type | The Lookout event type. | type |
| MAC Address | The MAC address. | details_macaddress |
| Network IP Addresses | Lists multiple network IP addresses. | details_networkthreatdetails_dnsipaddresses |
| Network MAC Address | The network MAC address. | details_networkthreatdetails_macaddress |
| Network Proxy IP Address | The network proxy IP address. | details_networkthreatdetails_proxyaddress |
| Network Proxy Port | The network proxy port. | details_networkthreatdetails_proxyport |
| Network Threat | The network threat. | details_networkthreatdetails_type |
| Network VPN IP Address | The network VPN IP address. | details_networkthreatdetails_vpnlocaladdress |
| Network VPN Present Boolean | The boolean variable, if present, of the network VPN. | details_networkthreatdetails_vpnpresent |
| Network Wireless Network ID | The network wireless network ID. | details_networkthreatdetails_ssid |
| OS Version | The version of the operating system. | details_osversion |
| Partner Name | The name of the partner. | partner_name |
| PCP Device Categories | Lists the priority code point device categories. | details_pcpcategories |
| PCP Device Response | Lists the priority code point device response. | details_pcpdeviceresponse |
| PCP Reporting Reason | Lists the priority code point reporting reason. | details_pcpreportingreason |
| PCP User Action | Lists the priority code point user action. | details_pcpuseraction |
| Platform | The platform of the object. | target_platform |
| Protection Status | The protection status. | details_protectionstatus |
| Proxy IP Address | The proxy IP address. | details_proxyaddress |
| Proxy Port | The proxy port. | details_proxyport |
| Target ID | The ID of the threat target. | target_id |
| Threat Action | The action of the threat. | details_action |
| Threat ID | A number identifying the threat. | details_id |
| Threat Indicators | The signals that identify the threat. | details_classifications |
| Threat Severity | The severity of the threat. | details_severity |
| Threat Type | The type of threat. | details_type |
| Trusted App Signing Identity | The identity of the object requesting code signing certificates to ensure an app is legitimate. | details_trustedsigningidentity |
| Updated Details | The updated details of a threat. | updateddetails |
| URL | The URL. | details_url |
| VPN IP Address | The VPN IP address. | details_vpnlocaladdress |
| VPN Present Boolean | The boolean variable, if present, for a VPN. | details_vpnpresent |
| Wireless Network ID | The ID of a wireless network. | details_ssid |
Netskope
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Accessed Cloud Object Type | The accessed cloud object type. | object_type |
| Action | The action. | action |
| Agent Address | The agent address. | agent_address |
| Agent DNS Domain | The agent DNS domain. | agent_dns_domain |
| Agent Host Name | The agent host name. | agent_host_name |
| Agent ID | The agent ID. | agent_id |
| Agent MAC Address | The agent MAC address. | agent_mac_address |
| Agent NT Domain | The agent NT domain. | agent_nt_domain |
| Agent Receipt Time | The agent receipt time. | agent_receipt_time |
| Agent Time Zone | The agent time zone. | agent_time_zone |
| Agent Translated Address | The agent translated address. | agent_translated_address |
| Agent Translated Zone External ID | The agent translated zone external ID. | agent_translated_zone_external_id |
| Agent Translated Zone URI | The agent translated zone URI. | agent_translated_zone_uri |
| Agent Type | The agent type. | agent_type |
| Agent Version | The agent version. | agent_version |
| Agent Zone External ID | The agent zone external ID. | agent_zone_external_id |
| Agent Zone URI | The agent zone URI. | agent_zone_uri |
| Alert Type | The alert type. | alert_type |
| App | The app. | app |
| App Category | The app category. | appcategory |
| App City | The app city. | dst_location |
| App Country | The app country. | dst_country |
| App IP | The app IP. | dstip |
| App Latitude | The app latitude. | dst_latitude |
| App login User Name | The app login user name. | from_user |
| App Longitude | The app longitude. | dst_longitude |
| App State | The app state. | dst_region |
| App timezone | The app time zone. | dst_timezone |
| App Zipcode | The app zip code | dst_zipcode |
| Application Protocol | The application protocol. | application_protocol |
| Base Event Count | The base event count. | base_event_count |
| Blocked Activity | The blocked activity. | app_activity |
| Breach Date | The breach date. | breach_date |
| Breach Score | The breach score. | breach_score |
| Browser Name | The browser name. | browser |
| Browser Version | The browser version. | browser_version |
| Bytes In | The bytes in. | bytes_in |
| Bytes Out | The bytes out. | bytes_out |
| CEF Date Prefix | The common event format date prefix. | cef_date_prefix |
| CEF Event ID | The unique ID assigned by ArcSight. | cef_event_id |
| CEF Host Prefix | The common event format host prefix. | cef_host_prefix |
| Customer External ID | The customer external ID. | customer_external_id |
| Customer URI | The customer URI. | customer_uri |
| Destination Address | The destination address. | destination_address |
| Destination DNS Domain | The destination DNS domain. | destination_dns_domain |
| Destination GEO Latitude | The destination GEO latitude. | destination_geo_latitude |
| Destination GEO Longitude | The destination GEO longitude. | destination_geo_longitude |
| Destination Host Name | The destination host name. | destination_host_name |
| Destination MAC Address | The destination MAC address. | destination_mac_address |
| Destination NT Domain | The destination NT domain. | destination_nt_domain |
| Destination Port | The destination port. | destination_port |
| Destination Process ID | The destination process ID. | destination_process_id |
| Destination Process Name | The destination process name. | destination_process_name |
| Destination Service Name | The destination service name. | destination_service_name |
| Destination Translated Address | The destination translated address. | destination_translated_address |
| Destination Translated Port | The destination translated port. | destination_translated_port |
| Destination Translated Zone External ID | The destination translated zone external ID. | destination_translated_zone_external_id |
| Destination Translated Zone URI | The destination translated zone URI. | destination_translated_zone_uri |
| Destination User ID | The destination user ID. | destination_user_id |
| Destination User Name | The destination user name. | destination_user_name |
| Destination User Privileges | The destination user privileges. | destination_user_privileges |
| Destination Zone External ID | The destination zone external ID. | destination_zone_external_id |
| Destination Zone URI | The destination zone URI. | destination_zone_uri |
| Detection Engine | The detection engine. | detection_engine |
| Device Action | The device action. | device_action |
| Device Address | The device address. | device_address |
| Device Custom Date 1 | The device custom date 1. | device_custom_date_1 |
| Device Custom Date 2 | The device custom date 2. | device_custom_date_2 |
| Device Custom Floating Point 1 | The device custom floating point 1. | device_custom_floating_point_1 |
| Device Custom Floating Point 2 | The device custom floating point 2. | device_custom_floating_point_2 |
| Device Custom Floating Point 3 | The device custom floating point 3. | device_custom_floating_point_3 |
| Device Custom Floating Point 4 | The device custom floating point 4. | device_custom_floating_point_4 |
| Device Custom IPV6 Address 1 | The device custom IPV6 address 1. | device_custom_ipv6_address_1 |
| Device Custom IPV6 Address 3 | The device custom IPV6 address 3. | device_custom_ipv6_address_3 |
| Device Custom IPV6 Address 4 | The device custom IPV6 address 4. | device_custom_ipv6_address_4 |
| Device Custom Number 1 | The device custom number 1. | device_custom_number_1 |
| Device Custom Number 2 | The device custom number 2. | device_custom_number_2 |
| Device Custom Number 3 | The device custom number 3. | device_custom_number_3 |
| Device Custom String 1 | The device custom string 1. | device_custom_string_1 |
| Device Custom String 2 | The device custom string 2. | device_custom_string_2 |
| Device Custom String 3 | The device custom string 3. | device_custom_string_3 |
| Device Custom String 4 | The device custom string 4. | device_custom_string_4 |
| Device Custom String 5 | The device custom string 5. | device_custom_string_5 |
| Device Custom String 6 | The device custom string 6. | device_custom_string_6 |
| Device Direction | The device direction. | device_direction |
| Device DNS Domain | The device DNS domain. | device_dns_domain |
| Device Event category | The device event category. | device_event_category |
| Device Event Class ID | The device event class ID. | device_event_class_id |
| Device External ID | The device external ID. | device_external_id |
| Device Facility | The device facility. | device_facility |
| Device Host Name | The device host name. | device_host_name |
| Device Hostname | The device host name. | hostname |
| Device Inbound Interface | The device inbound interface. | device_inbound_interface |
| Device MAC Address | The device MAC address. | device_mac_address |
| Device NT Domain | The device NT domain. | device_nt_domain |
| Device Outbound Interface | The device outbound interface. | device_outbound_interface |
| Device Payload ID | The device payload ID. | device_payload_id |
| Device Process ID | The device process ID. | device_process_id |
| Device Process Name | The device process name. | device_process_name |
| Device Product | The device product. | device_product |
| Device Receipt Time | The device receipt time. | device_receipt_time |
| Device Time Zone | The device time zone. | device_time_zone |
| Device Translated Address | The device translated address. | device_translated_address |
| Device Translated Zone External ID | The device translated zone external ID. | device_translated_zone_external_id |
| Device Translated Zone URI | The device translated zone URI. | device_translated_zone_uri |
| Device Type | The device type. | device |
| Device Vendor | The device vendor. | device_vendor |
| Device Version | The device version. | device_version |
| Device Zone External ID | The device zone external ID. | device_zone_external_id |
| Device Zone URI | The device zone URI. | device_zone_uri |
| DLP Violation File Name | The data loss prevention violation file name | dlp_file |
| End Time | The end time of an event, process, or period that marks completion or duration. | end_time |
| Event Exposure | The event exposure. | exposure |
| Event Name | The event name. | name |
| Event Outcome | The event outcome. | event_outcome |
| External ID | The external ID. | external_id |
| File Create Time | The file create time. | file_create_time |
| File Hash | The file hash. | file_hash |
| File ID | The file ID | file_id |
| File Modification Time | The file modification time. | file_modification_time |
| File Name | The file name. | file_name |
| File Original Name | The file original name. | from_object |
| File Path | The file path. | file_path |
| File Permission | The file permission. | file_permission |
| File Size | The file size. | file_size |
| File Type | The file type. | file_type |
| Flex Date 1 | The flex date 1. | flex_date_1 |
| Flex String 1 | The flex string 1. | flex_string_1 |
| Flex String 2 | The flex string 2. | flex_string_2 |
| Malware ID | The malware ID. | malware_id |
| Malware Name | The malware name. | malware_name |
| Malware Scan Result | The malware scan result. | malware_scanner_result |
| Malware Type | The malware type. | malware_type |
| Message Type | The message type. | message_type |
| Old File Create Time | The old file create time. | old_file_create_time |
| Old File Hash | The old file hash. | old_file_hash |
| Old File ID | The old file ID. | old_file_id |
| Old File Modification Time | The old file modification time. | old_file_modification_time |
| Old File Name | The old file name. | old_file_name |
| Old File Path | The old file path. | old_file_path |
| Old File Permission | The old file permission. | old_file_permission |
| Old File Size | The old file size. | old_file_size |
| Old File Type | The old file type. | old_file_type |
| Partner Name | The partner name. | partner_name |
| Raw Event | The raw event. | raw_event |
| Reason | The rationale for addressing a threat. | reason |
| Request Client Application | The request client application. | request_client_application |
| Request Context | The request context. | request_context |
| Request Cookies | The request cookies. | request_cookies |
| Request Method | The request method. | request_method |
| Request URL | The request URL | request_url |
| Severity | The threat severity. | severity |
| Source Address | The source address. | source_address |
| Source DNS Domain | The source DNS domain. | source_dns_domain |
| Source GEO Latitude | The source GEO latitude. | source_geo_latitude |
| Source GEO Longitude | The source GEO longitude. | source_geo_longitude |
| Source Host Name | The source host name. | source_host_name |
| Source MAC Address | The source MAC address. | source_mac_address |
| Source NT Domain | The source NT domain. | source_nt_domain |
| Source PORT | The source port. | source_port |
| Source Process ID | The source process ID. | source_process_id |
| Source Process Name | The source process name. | source_process_name |
| Source Service Name | The source service name. | source_service_name |
| Source Translated Address | The source translated address. | source_translated_address |
| Source Translated Port | The source translated port. | source_translated_port |
| Source Translated Zone External ID | The source translated zone external ID. | source_translated_zone_external_id |
| Source Translated Zone URI | The source translated zone URI. | source_translated_zone_uri |
| Source User ID | The source user ID. | source_user_id |
| Source User Name | The source user name. | source_user_name |
| Source User Privileges | The source user privileges. | source_user_privileges |
| Source Zone External ID | The source zone external ID. | source_zone_external_id |
| Source Zone URI | The source zone URI. | source_zone_uri |
| Start Time | The start time of the event, process, or period. | start_time |
| Transport Protocol | The transport protocol. | transport_protocol |
| Type | The type of threat. | type |
| User Activity | The user activity. | activity |
| User Email | The user email. | userkey |
Omnissa Workspace ONE Mobile Threat Defense
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Actor ID | The threat actor ID. | actor_id |
| Actor Type | The threat actor type. | actor_type |
| App Name | The app name. | details_applicationname |
| App Package Name | The app package name. | details_packagename |
| Changed Type | The type of change made by the threat. | changetype |
| Device Activation Status | The device activation status. | details_activationstatus |
| Device Email | The device email. | target_emailaddress |
| Device Manufacturer | The device manufacturer. | target_manufacturer |
| Device Model | The device model. | target_model |
| Device Security Status | The device security status. | details_securitystatus |
| File Name | The name of the file threatened. | details_filename |
| File Path | The path to the threatened file. | details_path |
| IP Address | The IP address. | details_dnsipaddresses |
| MAC Address | The MAC address. | details_macaddress |
| MTD Event Type | The Mobile Threat Defense event type. | type |
| Network IP Addresses | Lists the network IP addresses. | details_networkthreatdetails_dnsipaddresses |
| Network MAC Address | The network MAC address. | details_networkthreatdetails_macaddress |
| Network Proxy Port | The network proxy port. | details_networkthreatdetails_proxyport |
| Network Threat | The network threat. | details_networkthreatdetails_type |
| Network VPN IP Address | The network VPN IP address. | details_networkthreatdetails_vpnlocaladdress |
| Network VPN Present Boolean | The boolean, if present, of the network VPN. | details_networkthreatdetails_vpnpresent |
| Network Wireless Network ID | The network wireless network ID. | details_networkthreatdetails_ssid |
| Partner Name | The partner name. | partner_name |
| PCP Device Categories | Lists the priority code point device categories. | details_pcpcategories |
| PCP Device Response | Lists the priority code point device response. | details_pcpdeviceresponse |
| PCP Reporting Reason | Lists the priority code point reporting reason. | details_pcpreportingreason |
| Protection Status | The protection status. | details_protectionstatus |
| Proxy IP Address | The proxy IP address. | details_proxyaddress |
| Proxy Port | The proxy port. | details_proxyport |
| Target ID | The target ID. | target_id |
| Threat Action | The threat action. | details_action |
| Threat ID | The threat ID. | details_id |
| Threat Indicators | The signals indicating the threat. | details_classifications |
| Trusted App Signing Identity | The identity of the object requesting code signing certificates to ensure an app is legitimate. | details_trustedsigningidentity |
| Updated Details | The updated details. | updateddetails |
| URL | The URL. | details_url |
| VPN IP Address | The VPN IP address. | details_vpnlocaladdress |
| VPN Present Boolean | The boolean, if present, of the VPN. | details_vpnpresent |
| Wireless Network ID | The wireless network ID. | details_ssid |
Pradeo
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Agent Address | The agent address. | agent_address |
| Agent DNS Domain | The agent DNS domain. | agent_dns_domain |
| Agent Host Name | The agent host name. | agent_host_name |
| Agent ID | The agent ID. | agent_id |
| Agent MAC Address | The agent MAC address. | agent_mac_address |
| Agent NT Domain | The agent NT domain. | agent_nt_domain |
| Agent Receipt Time | The agent receipt time. | agent_receipt_time |
| Agent Time Zone | The agent time zone. | agent_time_zone |
| Agent Translated Address | The agent translated address. | agent_translated_address |
| Agent Translated Zone External ID | The agent translated zone external ID. | agent_translated_zone_external_id |
| Agent Translated Zone URI | The agent translated zone URI. | agent_translated_zone_uri |
| Agent Type | The agent type. | agent_type |
| Agent Version | The agent version. | agent_version |
| Agent Zone External ID | The agent zone external ID. | agent_zone_external_id |
| Agent Zone URI | The agent zone URI. | agent_zone_uri |
| Application Protocol | The application protocol. | application_protocol |
| Base Event Count | The base event count. | base_event_count |
| Bytes In | The bytes in. | bytes_in |
| Bytes Out | The bytes out. | bytes_out |
| CEF Date Prefix | The common event format date prefix. | cef_date_prefix |
| CEF Event ID | The unique ID assigned by ArcSight. | cef_event_id |
| CEF Host Prefix | The common event format host prefix. | cef_host_prefix |
| Customer External ID | The customer external ID. | customer_external_id |
| Customer URI | The customer URI. | customer_uri |
| Destination Address | The destination address. | destination_address |
| Destination DNS Domain | The destination DNS domain. | destination_dns_domain |
| Destination GEO Latitude | The destination GEO latitude. | destination_geo_latitude |
| Destination GEO Longitude | The destination GEO longitude. | destination_geo_longitude |
| Destination Host Name | The destination host name. | destination_host_name |
| Destination MAC Address | The destination MAC address. | destination_mac_address |
| Destination NT Domain | The destination NT domain. | destination_nt_domain |
| Destination Port | The destination port. | destination_port |
| Destination Process ID | The destination process ID. | destination_process_id |
| Destination Process Name | The destination process name. | destination_process_name |
| Destination Service Name | The destination service name. | destination_service_name |
| Destination Translated Address | The destination translated address. | destination_translated_address |
| Destination Translated Port | The destination translated port. | destination_translated_port |
| Destination Translated Zone External ID | The destination translated zone external ID. | destination_translated_zone_external_id |
| Destination Translated Zone URI | The destination translated zone URI. | destination_translated_zone_uri |
| Destination User ID | The destination user ID. | destination_user_id |
| Destination User Name | The destination user name. | destination_user_name |
| Destination User Privileges | The destination user privileges. | destination_user_privileges |
| Destination Zone External ID | The destination zone external ID. | destination_zone_external_id |
| Destination Zone URI | The destination zone URI. | destination_zone_uri |
| Device Action | The device action. | device_action |
| Device Address | The device address. | device_address |
| Device Custom Date 1 | The device custom date 1. | device_custom_date_1 |
| Device Custom Date 2 | The device custom date 2. | device_custom_date_2 |
| Device Custom Floating Point 1 | The device custom floating point 1. | device_custom_floating_point_1 |
| Device Custom Floating Point 2 | The device custom floating point 2. | device_custom_floating_point_2 |
| Device Custom Floating Point 3 | The device custom floating point 3. | device_custom_floating_point_3 |
| Device Custom Floating Point 4 | The device custom floating point 4. | device_custom_floating_point_4 |
| Device Custom IPV6 Address 1 | The device custom IPV6 address 1. | device_custom_ipv6_address_1 |
| Device Custom IPV6 Address 3 | The device custom IPV6 address 3. | device_custom_ipv6_address_3 |
| Device Custom IPV6 Address 4 | The device custom IPV6 address 4. | device_custom_ipv6_address_4 |
| Device Custom Number 1 | The device custom number 1. | device_custom_number_1 |
| Device Custom Number 2 | The device custom number 2. | device_custom_number_2 |
| Device Custom Number 3 | The device custom number 3. | device_custom_number_3 |
| Device Custom String 1 | The device custom string 1. | device_custom_string_1 |
| Device Custom String 2 | The device custom string 2. | device_custom_string_2 |
| Device Custom String 3 | The device custom string 3. | device_custom_string_3 |
| Device Custom String 4 | The device custom string 4. | device_custom_string_4 |
| Device Custom String 5 | The device custom string 5. | device_custom_string_5 |
| Device Custom String 6 | The device custom string 6. | device_custom_string_6 |
| Device Direction | The device direction. | device_direction |
| Device DNS Domain | The device DNS domain. | device_dns_domain |
| Device Event category | The device event category. | device_event_category |
| Device Event Class ID | The device event class ID. | device_event_class_id |
| Device External ID | The device external ID. | device_external_id |
| Device facility | The device facility. | device_facility |
| Device Host Name | The device host name. | device_host_name |
| Device Inbound Interface | The device inbound interface. | device_inbound_interface |
| Device MAC Address | The device MAC address. | device_mac_address |
| Device NT Domain | The device NT domain. | device_nt_domain |
| Device Outbound Interface | The device outbound interface. | device_outbound_interface |
| Device Payload ID | The device payload ID. | device_payload_id |
| Device Process ID | The device process ID. | device_process_id |
| Device Process Name | The device process name. | device_process_name |
| Device Product | The device product. | device_product |
| Device Receipt Time | The device receipt time. | device_receipt_time |
| Device Time Zone | The device time zone. | device_time_zone |
| Device Translated Address | The device translated address. | device_translated_address |
| Device Translated Zone External ID | The device translated zone external ID. | device_translated_zone_external_id |
| Device Translated Zone URI | The device translated zone URI. | device_translated_zone_uri |
| Device Vendor | The device vendor. | device_vendor |
| Device Version | The device version. | device_version |
| Device Zone External ID | The device zone external ID. | device_zone_external_id |
| Device Zone URI | The device zone URI. | device_zone_uri |
| End Time | The end time of an event, process, or period that marks completion or duration. | end_time |
| Event Name | The event name. | name |
| Event Outcome | The event outcome. | event_outcome |
| External ID | The external ID. | external_id |
| Facility | The facility. | facility |
| File Create Time | The file create time. | file_create_time |
| File Hash | The file hash. | file_hash |
| File ID | The file ID. | file_id |
| File Modification Time | The file modification time. | file_modification_time |
| File Name | The file name. | file_name |
| File Path | The file path. | file_path |
| File Permission | The file permission. | file_permission |
| File Size | The file size. | file_size |
| File Type | The file type. | file_type |
| Flex Date 1 | The flex date 1. | flex_date_1 |
| Flex String 1 | The flex string 1. | flex_string_1 |
| Flex String 2 | The flex string 2. | flex_string_2 |
| Level | The threat level. | level |
| Message | An arbitrary message that provides more details about events. | msg |
| Message ID | The message ID. | message_id |
| Message Type | The message type. | message_type |
| Old File Create Time | The old file create time. | old_file_create_time |
| Old File Hash | The old file hash. | old_file_hash |
| Old File ID | The old file ID. | old_file_id |
| Old File Modification Time | The old file modification time. | old_file_modification_time |
| Old File Name | The old file name. | old_file_name |
| Old File Path | The old file path. | old_file_path |
| Old File Permission | The old file permission. | old_file_permission |
| Old File Size | The old file size. | old_file_size |
| Old File Type | The old file type. | old_file_type |
| Partner Device Identifier | The partner device identifier. | partner_device_identifier |
| Partner Name | The partner name. | partner_name |
| Process ID | The process ID. | process_id |
| Raw Event | The raw event. | raw_event |
| Reason | The rationale for addressing a threat. | reason |
| Remote Address | The remote address. | remote_address |
| Request Client Application | The request client application. | request_client_application |
| Request Context | The request context. | request_context |
| Request Cookies | The request cookies. | request_cookies |
| Request Method | The request method. | request_method |
| Request URL | The request URL. | request_url |
| Severity | The threat severity. | severity |
| Source Address | The source address. | source_address |
| Source DNS Domain | The source DNS domain. | source_dns_domain |
| Source GEO Latitude | The source GEO latitude. | source_geo_latitude |
| Source GEO Longitude | The source GEO longitude. | source_geo_longitude |
| Source Host Name | The source host name. | source_host_name |
| Source MAC Address | The source MAC address. | source_mac_address |
| Source NT Domain | The source NT domain. | source_nt_domain |
| Source PORT | The source port. | source_port |
| Source Process ID | The source process ID. | source_process_id |
| Source Process Name | The source process name. | source_process_name |
| Source Service Name | The source service name. | source_service_name |
| Source Translated Address | The source translated address. | source_translated_address |
| Source Translated Port | The source translated port. | source_translated_port |
| Source Translated Zone External ID | The source translated zone external ID. | source_translated_zone_external_id |
| Source Translated Zone URI | The source translated zone URI. | source_translated_zone_uri |
| Source User ID | The source user ID. | source_user_id |
| Source User Name | The source user name. | source_user_name |
| Source User Privileges | The source user privileges. | source_user_privileges |
| Source Zone External ID | The source zone external ID. | source_zone_external_id |
| Source Zone URI | The source zone URI. | source_zone_uri |
| Start Time | The start time of the event, process, or period. | start_time |
| Structure Data | The structure data. | structure_data |
| Transport Protocol | The transport protocol. | transport_protocol |
| Type | The type of threat. | type |
Wandera
| Data Fields | Definitions | Raw Data Names |
|---|---|---|
| Agent Address | The agent address. | agent_address |
| Agent DNS Domain | The agent DNS domain. | agent_dns_domain |
| Agent Host Name | The agent host name. | agent_host_name |
| Agent ID | The agent ID. | agent_id |
| Agent MAC Address | The agent MAC address. | agent_mac_address |
| Agent NT Domain | The agent NT domain. | agent_nt_domain |
| Agent Receipt Time | The agent receipt time. | agent_receipt_time |
| Agent Time Zone | The agent time zone. | agent_time_zone |
| Agent Translated Address | The agent translated address. | agent_translated_address |
| Agent Translated Zone External ID | The agent translated zone external ID. | agent_translated_zone_external_id |
| Agent Translated Zone URI | The agent translated zone URI. | agent_translated_zone_uri |
| Agent Type | The agent type. | agent_type |
| Agent Version | The agent version. | agent_version |
| Agent Zone External ID | The agent zone external ID. | agent_zone_external_id |
| Agent Zone URI | The agent zone URI. | agent_zone_uri |
| Application Protocol | The application protocol. | application_protocol |
| Base Event Count | The base event count. | base_event_count |
| Bytes In | The bytes in. | bytes_in |
| Bytes Out | The bytes out. | bytes_out |
| CEF Date Prefix | The common event format date prefix. | cef_date_prefix |
| CEF Event ID | The unique ID assigned by ArcSight. | cef_event_id |
| CEF Host Prefix | The common event format host prefix. | cef_host_prefix |
| Customer External ID | The customer external ID. | customer_external_id |
| Customer URI | The customer URI. | customer_uri |
| Destination Address | The destination address. | destination_address |
| Destination DNS Domain | The destination DNS domain. | destination_dns_domain |
| Destination GEO Latitude | The destination GEO latitude. | destination_geo_latitude |
| Destination GEO Longitude | The destination GEO longitude. | destination_geo_longitude |
| Destination Host Name | The destination host name. | destination_host_name |
| Destination MAC Address | The destination MAC address. | destination_mac_address |
| Destination NT Domain | The destination NT domain. | destination_nt_domain |
| Destination Port | The destination port. | destination_port |
| Destination Process ID | The destination process ID. | destination_process_id |
| Destination Process Name | The destination process name. | destination_process_name |
| Destination Service Name | The destination service name. | destination_service_name |
| Destination Translated Address | The destination translated address. | destination_translated_address |
| Destination Translated Port | The destination translated port. | destination_translated_port |
| Destination Translated Zone External ID | The destination translated zone external ID. | destination_translated_zone_external_id |
| Destination Translated Zone URI | The destination translated zone URI. | destination_translated_zone_uri |
| Destination User ID | The destination user ID. | destination_user_id |
| Destination User Name | The destination user name. | destination_user_name |
| Destination User Privileges | The destination user privileges. | destination_user_privileges |
| Destination Zone External ID | The destination zone external ID. | destination_zone_external_id |
| Destination Zone URI | The destination zone URI. | destination_zone_uri |
| Device Action | The device action. | device_action |
| Device Address | The device address. | device_address |
| Device Custom Date 1 | The device custom date 1. | device_custom_date_1 |
| Device Custom Date 2 | The device custom date 2. | device_custom_date_2 |
| Device Custom Floating Point 1 | The device custom floating point 1. | device_custom_floating_point_1 |
| Device Custom Floating Point 2 | The device custom floating point 2. | device_custom_floating_point_2 |
| Device Custom Floating Point 3 | The device custom floating point 3. | device_custom_floating_point_3 |
| Device Custom Floating Point 4 | The device custom floating point 4. | device_custom_floating_point_4 |
| Device Custom IPV6 Address 1 | The device custom IPV6 address 1. | device_custom_ipv6_address_1 |
| Device Custom IPV6 Address 3 | The device custom IPV6 address 3. | device_custom_ipv6_address_3 |
| Device Custom IPV6 Address 4 | The device custom IPV6 address 4. | device_custom_ipv6_address_4 |
| Device Custom Number 1 | The device custom number 1. | device_custom_number_1 |
| Device Custom Number 2 | The device custom number 2. | device_custom_number_2 |
| Device Custom Number 3 | The device custom number 3. | device_custom_number_3 |
| Device Custom String 1 | The device custom string 1. | device_custom_string_1 |
| Device Custom String 2 | The device custom string 2. | device_custom_string_2 |
| Device Custom String 3 | The device custom string 3. | device_custom_string_3 |
| Device Custom String 4 | The device custom string 4. | device_custom_string_4 |
| Device Custom String 5 | The device custom string 5. | device_custom_string_5 |
| Device Custom String 6 | The device custom string 6. | device_custom_string_6 |
| Device Direction | The device direction. | device_direction |
| Device DNS Domain | The device DNS domain. | device_dns_domain |
| Device Event category | The device event category. | device_event_category |
| Device Event Class ID | The device event class ID. | device_event_class_id |
| Device External ID | The device external ID. | device_external_id |
| Device facility | The device facility. | device_facility |
| Device Host Name | The device host name. | device_host_name |
| Device Inbound Interface | The device inbound interface. | device_inbound_interface |
| Device MAC Address | The device MAC address. | device_mac_address |
| Device NT Domain | The device NT domain. | device_nt_domain |
| Device Outbound Interface | The device outbound interface. | device_outbound_interface |
| Device Payload ID | The device payload ID. | device_payload_id |
| Device Process ID | The device process ID. | device_process_id |
| Device Process Name | The device process name. | device_process_name |
| Device Product | The device product. | device_product |
| Device Receipt Time | The device receipt time. | device_receipt_time |
| Device Time Zone | The device time zone. | device_time_zone |
| Device Translated Address | The device translated address. | device_translated_address |
| Device Translated Zone External ID | The device translated zone external ID. | device_translated_zone_external_id |
| Device Translated Zone URI | The device translated zone URI. | device_translated_zone_uri |
| Device Vendor | The device vendor. | device_vendor |
| Device Version | The device version. | device_version |
| Device Zone External ID | The device zone external ID. | device_zone_external_id |
| Device Zone URI | The device zone URI. | device_zone_uri |
| End Time | The end time of an event, process, or period that marks completion or duration. | end_time |
| Event Name | The event name. | name |
| Event Outcome | The event outcome. | event_outcome |
| External ID | The external ID. | external_id |
| Facility | The facility. | facility |
| File Create Time | The file create time. | file_create_time |
| File Hash | The file hash. | file_hash |
| File ID | The file ID. | file_id |
| File Modification Time | The file modification time. | file_modification_time |
| File Name | The file name. | file_name |
| File Path | The file path. | file_path |
| File Permission | The file permission. | file_permission |
| File Size | The file size. | file_size |
| File Type | The file type. | file_type |
| Flex Date 1 | The flex date 1. | flex_date_1 |
| Flex String 1 | The flex string 1. | flex_string_1 |
| Flex String 2 | The flex string 2. | flex_string_2 |
| Level | The threat level. | level |
| Message | An arbitrary message that provides more details about events. | msg |
| Message ID | The message ID. | message_id |
| Message Type | The message type. | message_type |
| Old File Create Time | The old file create time. | old_file_create_time |
| Old File Hash | The old file hash. | old_file_hash |
| Old File ID | The old file ID. | old_file_id |
| Old File Modification Time | The old file modification time. | old_file_modification_time |
| Old File Name | The old file name. | old_file_name |
| Old File Path | The old file path. | old_file_path |
| Old File Permission | The old file permission. | old_file_permission |
| Old File Size | The old file size. | old_file_size |
| Old File Type | The old file type. | old_file_type |
| Partner Device Identifier | The partner device identifier. | partner_device_identifier |
| Partner Name | The partner name. | partner_name |
| Process ID | The process ID. | process_id |
| Raw Event | The raw event. | raw_event |
| Reason | The rationale for addressing a threat. | reason |
| Remote Address | The remote address. | remote_address |
| Request Client Application | The request client application. | request_client_application |
| Request Context | The request context. | request_context |
| Request Cookies | The request cookies. | request_cookies |
| Request Method | The request method. | request_method |
| Request URL | The request URL. | request_url |
| Severity | The severity of the threat. | severity |
| Source Address | The source address. | source_address |
| Source DNS Domain | The source DNS domain. | source_dns_domain |
| Source GEO Latitude | The source GEO latitude. | source_geo_latitude |
| Source GEO Longitude | The source GEO longitude. | source_geo_longitude |
| Source Host Name | The source host name. | source_host_name |
| Source MAC Address | The source MAC address. | source_mac_address |
| Source NT Domain | The source NT domain. | source_nt_domain |
| Source PORT | The source port. | source_port |
| Source Process ID | The source process ID. | source_process_id |
| Source Process Name | The source process name. | source_process_name |
| Source Service Name | The source service name. | source_service_name |
| Source Translated Address | The source translated address. | source_translated_address |
| Source Translated Port | The source translated port. | source_translated_port |
| Source Translated Zone External ID | The source translated zone external ID. | source_translated_zone_external_id |
| Source Translated Zone URI | The source translated zone URI. | source_translated_zone_uri |
| Source User ID | The source user ID. | source_user_id |
| Source User Name | The source user name. | source_user_name |
| Source User Privileges | The source user privileges. | source_user_privileges |
| Source Zone External ID | The source zone external ID. | source_zone_external_id |
| Source Zone URI | The source zone URI. | source_zone_uri |
| Start Time | The start time of the event, process, or period. | start_time |
| Structure Data | The structure data. | structure_data |
| Transport Protocol | The transport protocol. | transport_protocol |
| Type | The type of threat. | type |
Was deze pagina nuttig?