> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Event Keys

The following is a list of all the event keys with a definition of their function and the type of the key.

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Access Control Outcome</td>
      <td>Outcome from Access Control</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Access Key ID</td>
      <td>The access key ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Account ID</td>
      <td>The account ID that generated the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Account Name</td>
      <td>The account name that generated the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Account Vendor</td>
      <td>Vendor name of the account ID owner</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Action Token jti</td>
      <td>The action token's jti</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Ad-hoc Query ID</td>
      <td>ID of the ad-hoc query</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Affected Family</td>
      <td>Software family affected by the current CPE</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Affected Platform</td>
      <td>The platform (Linux, Mac OSX, Windows) affected by an IDS event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Affected Platforms</td>
      <td>Software Platforms affected by the current CPE</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Affected Products</td>
      <td>Software Products affected by the current CPE</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Agent UUID</td>
      <td>The unique ID for agent event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Alarm Connector IDs</td>
      <td>Connector IDs in the alarm</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Alarm Connector Sources </td>
      <td>Connector Sources in the alarm</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Alarm Destination Asset IDs</td>
      <td>CSV of alarm destination asset IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Blacklist Activity</td>
      <td>CVS of Observed activities of the IP addresses to cause it to be put into OTX</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Cities</td>
      <td>CSV of alarm destination cities</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Countries</td>
      <td>CSV of alarm destination countries</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Hostnames</td>
      <td>Array of alarm destination hostnames</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination IPs</td>
      <td>Array of alarm destination IPs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Latitudes</td>
      <td>CSV of alarm destination latitudes</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Longitudes</td>
      <td>CSV of alarm destination longitudes</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Names</td>
      <td>Array with the destinations names of an alarm</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Organisations</td>
      <td>CSV of alarm destination organisations</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination User Account IDs </td>
      <td>Array of alarm destination user account IDs </td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination User IDs </td>
      <td>Array of alarm destination user IDs </td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Users</td>
      <td>Array of alarm destination users</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destination Zones</td>
      <td>CSV of alarm destination zones</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Destinations</td>
      <td>Array with the destinations of an alarm</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Events Count</td>
      <td>Total number of events in an alarm</td>
      <td>Long</td>
    </tr>

    <tr>
      <td>Alarm ID</td>
      <td>The ID associated with the alarm</td>
      <td>String </td>
    </tr>

    <tr>
      <td>Alarm Labels</td>
      <td>Array with the alarm labels IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Response Codes</td>
      <td>Array of alarm response codes</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Sensor Sources</td>
      <td>Array of the sensor sources which originate the alarm</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Asset IDS</td>
      <td>CSV of alarm source asset IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Blacklist Activity</td>
      <td>CVS of observed activities of the IP addresses to cause it to be put into OTX</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Cities</td>
      <td>CSV of alarm source cities</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Countries</td>
      <td>CSV of alarm source countries</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Hostnames</td>
      <td>Array of alarm source hostnames</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source IPS</td>
      <td>Array of alarm source IPs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Latitudes</td>
      <td>CSV of alarm source  latitudes</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Longitudes</td>
      <td>CSV of alarm source longitudes</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Names</td>
      <td>Array of the unique sources names for an alarm</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Organisations</td>
      <td>CSV of alarm source organisations</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source User Account IDS</td>
      <td>Array of alarm source user account ids</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source User IDS</td>
      <td>Array of alarm source user ids</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Users</td>
      <td>Array  of alarm source users</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Source Zones</td>
      <td>CSV of alarm source zones</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Alarm Sources</td>
      <td>Array of the unique sources for an alarm</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Analysis Account ID</td>
      <td>The ID of the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis Account Name</td>
      <td>The name of the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis Account Status</td>
      <td>The status of the user account</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Analysis Account Type</td>
      <td>The type of user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis Account User Name</td>
      <td>The user name associated with the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis User ID</td>
      <td>The ID of the user</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis  User Name</td>
      <td>The name of the user</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Analysis  User Status</td>
      <td>The status of the user</td>
      <td>String</td>
    </tr>

    <tr>
      <td>App Execution Parameters</td>
      <td>The application execution parameters</td>
      <td>String</td>
    </tr>

    <tr>
      <td>App ID</td>
      <td>The ID of the App which generated this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>App Name</td>
      <td>The Name of the App which generated this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>App Type</td>
      <td>The App type which generated this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Application Protocol</td>
      <td>Layer-7 protocol observed in the event (eg SSH, FTP, SNMP)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Application Type</td>
      <td>Application type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Application </td>
      <td>Application name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Asset Group ID</td>
      <td>The ID of the Asset Group in AssetDB</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Asset Status</td>
      <td>Asset Status</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Asset Tag</td>
      <td>Asset metadata name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Asset Tag Value</td>
      <td>Asset metadata value</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Assumed Role</td>
      <td>Assumed role from AWS CloudTrail events</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Audit Reason</td>
      <td>The reason an audit event was generated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Authentication Mode</td>
      <td>Authentication Mode</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Authentication Package Name</td>
      <td>The name of the authentication package used</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Authentication Type</td>
      <td>The method used be the user to authenticate, such as RSA Key, Password, Domain Credentials</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Base Event Count</td>
      <td>A count associated with how many times was this same event observed</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Blacklist Name</td>
      <td>The name listed on the blacklist</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Blacklist Reference URL</td>
      <td>The referencing URL from the blacklist</td>
      <td>URL</td>
    </tr>

    <tr>
      <td>Blacklist Violating IP</td>
      <td>The IP registered to the blacklist</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Bytes in</td>
      <td>The number of bytes in a HTTP request</td>
      <td>Long</td>
    </tr>

    <tr>
      <td>Bytes out</td>
      <td>he number of bytes in a HTTP response</td>
      <td>Long</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Case Numbers</td>
      <td>Array of case numbers</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Category ID</td>
      <td>The id of the taxonomy of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Certificate Issuer Name</td>
      <td>The issuer name of the certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Certificate Serial Number</td>
      <td>The serial number of the certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Certificate Subject Name</td>
      <td>The subject name of the certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Changed Client</td>
      <td>The ID of the client that was modified</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Confidence</td>
      <td>Confidence level</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Connection Count</td>
      <td>Number of incoming connections</td>
      <td>Long</td>
    </tr>

    <tr>
      <td>Connector ID</td>
      <td>The ID of the connector that generated the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Connector Source File</td>
      <td>The source file of the connector that generated the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Connector Source</td>
      <td>The source of the connector that generated the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Console Login</td>
      <td>The outcome of a AWS console login try</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Consumer</td>
      <td>Consumer of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container CMD</td>
      <td>Container CMD</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container CPU</td>
      <td>Container CPU</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container ID</td>
      <td>The ID of the container</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Image</td>
      <td>The image name used to launch the container</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Image ID</td>
      <td>The id of the image used to launch the container</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Memory</td>
      <td>Container Memory</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Name</td>
      <td>The name of the container</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Security Context</td>
      <td>Container security context</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container State</td>
      <td>The state of the container</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Container Volume</td>
      <td>Container volume</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Contains Credit Card Number</td>
      <td>The event contains credit card numbers</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Content Category</td>
      <td>Category of the content is being inspected as part of the connection For example in a Content Filtering or Proxy device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Control ID</td>
      <td>The Control Node ID which will process this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Current PPS</td>
      <td>Number of current packets per second (PPS)</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Current Working Directory</td>
      <td>The Current Working Directory (CWD) referenced in the event</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Datascience Anomaly Score</td>
      <td>The score (0-1, floating point) indicating how anomalous the event is. The closer to 1, the more anomalous</td>
      <td>Double</td>
    </tr>

    <tr>
      <td>Datascience Inference Explanation</td>
      <td>A JSON string representing the explanation map/dictionary of the prediction/inference</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Datascience Inference Type </td>
      <td>A string representing the type of inference done on the event. For example, Anomalous Login Time</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Datascience Inference Value Data Type </td>
      <td>A string representing the data type of the value of inference result. For example, integer, float, categorical, etc.</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Datascience Inference Value</td>
      <td>A string representing the value of inference result--something human understandable and able to write rules against</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Account ID</td>
      <td>Destination user account in the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Account Name</td>
      <td>Destination Account name where the event was generated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Account </td>
      <td>Destination Account where the event was generated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination</td>
      <td>This is compared against several known formats to extract relevant data. For example, \<hostname>:\<port>:\<zone>, etc.</td>
      <td>Network Info</td>
    </tr>

    <tr>
      <td>Destination Additional Hostnames</td>
      <td>Destination additional hostnames</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Destination Address</td>
      <td>Destination IP Address</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination Address 6</td>
      <td>Destination IP Address in v6 format</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination ASN</td>
      <td>Destination ASN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Asset ID</td>
      <td>CSV of alarm destination asset IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Destination Blacklist Activity</td>
      <td>CVS of observed activities of the IP addresses to cause it to be put into OTX</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Destination Blacklist Priority</td>
      <td>OTX priority</td>
      <td>String </td>
    </tr>

    <tr>
      <td>Destination Blacklist Reliability</td>
      <td>OTX reliability</td>
      <td>String </td>
    </tr>

    <tr>
      <td>Destination canonical </td>
      <td>Canonical Destination</td>
      <td>String </td>
    </tr>

    <tr>
      <td>Destination City</td>
      <td>Destination City</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Country</td>
      <td>Destination Country</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination CPE</td>
      <td>Destination CPE</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Datacenter</td>
      <td>Destination data center</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Datastore</td>
      <td>Destination data store</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination DNS Domain</td>
      <td>The DNS domain part of the complete fully qualified domain name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination FQDN</td>
      <td>Destination FQDN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Hostname</td>
      <td>Destination hostname</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Infrastructure Name</td>
      <td>Destination Infrastructure Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Infrastructure Type</td>
      <td>Destination Infrastructure Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Instance ID</td>
      <td>Instance ID for destination device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Latitude</td>
      <td>Destinations Latitude</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Location ID</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Location Name</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Longitude</td>
      <td>Destinations Longitude</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination MAC </td>
      <td>Destination MAC Address</td>
      <td>MAC</td>
    </tr>

    <tr>
      <td>Destination MAC Vendor</td>
      <td>Destination MAC Vendor</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Name</td>
      <td>Destination Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination NAT Address</td>
      <td>Destination NAT IP Address</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination NAT Port</td>
      <td>Destination NAT Port</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Destination Netmask</td>
      <td>Destination IP Address mask</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination Network</td>
      <td>Destination network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination NT domain</td>
      <td>Destination Windows Domain</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Organisation</td>
      <td>Destinations Organisation</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Port Label</td>
      <td>Destination Port Label</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Port</td>
      <td>Destination Port</td>
      <td>Port</td>
    </tr>

    <tr>
      <td>Destination Post NAT Address</td>
      <td>Destination address for the event message after NAT occurred</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination Post NAT Port</td>
      <td>Port number of the event destination after NAT</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Destination Pre NAT Address</td>
      <td>Destination address for the event message before NAT</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination Pre NAT Port</td>
      <td>Port number of the event destination before NAT</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Destination Process</td>
      <td>Destination Process Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Process ID</td>
      <td>Destination Process ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Process User</td>
      <td>Destination Process User</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Region</td>
      <td>Destinations Region</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Registered Country</td>
      <td>Destination Registered Country</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Service Name</td>
      <td>The service which is targeted by this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Translated Address</td>
      <td>Identifies the translated destination address that the event refers to in an IP network</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Destination Translated Port</td>
      <td>Port after it was translated</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Destination User Email</td>
      <td>Destinations User email</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination User Group</td>
      <td>The destination user group</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination User ID</td>
      <td>Destination user in the system</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination User Privileges</td>
      <td>Destinations Users privileges</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination UserID</td>
      <td>Destinations Users numeric ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Username</td>
      <td>Destinations User name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination VGuest</td>
      <td>Destination virtual guest</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination VHost</td>
      <td>Destination virtual host</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination VPC</td>
      <td>Destination VPC</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destinations VPN</td>
      <td>Destinations VPN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Workstation</td>
      <td>Destinations workstation name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destination Zone</td>
      <td>Destinations Zone (DMZ Office Outside)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Destinations</td>
      <td>List of destination asset IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Device Class</td>
      <td>The Device Class listed in the system</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Configuration</td>
      <td>Configuration scheme/type set in a device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Custom Date 1-2</td>
      <td>There are two timestamps fields available which can be used to map fields which do not fit any other field of this dictionary</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Custom Date 1-2 Label</td>
      <td>All custom fields have a corresponding label field where the field itself can be described</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Custom Number 1-3</td>
      <td>There are three number fields available which can be used to map fields which do not fit into any other field of this dictionary</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Device Custom Number 1-3 Label</td>
      <td>All custom fields have a corresponding label field where the field itself can be described</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Direction</td>
      <td>Any information about what direction the communication that was observed has taken</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device DNS Domain</td>
      <td>The DNS domain part of the complete fully qualified domain name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Event Category</td>
      <td>Represents the category assigned by the originating device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device External ID</td>
      <td>A name that uniquely identifies the device generating this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Facility</td>
      <td>The facility generating this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Inbound Interface</td>
      <td>Interface on which the packet or data entered the device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Name</td>
      <td>The Device Name listed in the system</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device NT Domain</td>
      <td>Device Windows Domain</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Outbound Interface</td>
      <td>Interface on which the packet or data left the device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Process Name</td>
      <td>Process name associated to the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Sender Address</td>
      <td>Device sender address</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Device Sender Asset ID</td>
      <td>Asset ID for device sender</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Time Format</td>
      <td>Format of the timestamp attached to this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Device Translated Address</td>
      <td>Identifies the translated device address that the event refers to in an IP network</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Device Vendor</td>
      <td>The device vendor</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS Message</td>
      <td>DNS response message</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS Rcode</td>
      <td>DNS return message</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>DNS RR Name</td>
      <td>The DNS Request/Response Resource Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS RR Type</td>
      <td>The DNS Resource Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS Server Address</td>
      <td>The address of the DNS server referenced in the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS TTL</td>
      <td>The DNS Time to Live</td>
      <td>String</td>
    </tr>

    <tr>
      <td>DNS Type</td>
      <td>The DNS Type (Query / Answer)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Duration</td>
      <td>The duration of the connection</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Email Recipient</td>
      <td>The Email recipient</td>
      <td>Email</td>
    </tr>

    <tr>
      <td>Email Relay</td>
      <td>The relay the email was delivered through</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Email Sender</td>
      <td>The Email sender</td>
      <td>Email</td>
    </tr>

    <tr>
      <td>Email Subject</td>
      <td>The subject of the email</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Entity Category</td>
      <td>The zone category of incident that is being reported</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Environment Variable Key</td>
      <td>The Environment Variable key referenced in the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Environment Variable Value</td>
      <td>The Environment Variable value referenced in the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Error Code</td>
      <td>The error code for a HTTP response</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Error Message</td>
      <td>The error message for a response</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Action</td>
      <td>The implied action of the event - Create Read Update Delete</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Activity</td>
      <td>The activity related to an event In an IDS event this would be the activity being detected</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Attack ID </td>
      <td>The ID associated with an event reporting an attack</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Attack Tactic</td>
      <td>The attack tactic type associated with an event reporting an attack</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Attack Technique</td>
      <td>The attack technique associated with an event reporting an attack</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Auth Action</td>
      <td>Action of the authorization event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Auth Role</td>
      <td>Role of the authorization event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Auth Scope</td>
      <td>Scope of the authorization event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Category</td>
      <td>The taxonomy of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Change</td>
      <td>The event change/action made by the user</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event CVE</td>
      <td>Contains information about the CVE associated with an event as an example an IDS signature</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Description URL</td>
      <td>The URL for full description of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Description </td>
      <td>Full description of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Group</td>
      <td>Event Grouping that this event belongs to</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Group Job ID</td>
      <td>When this group has been created from a job, the job ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Group Type</td>
      <td>Define which kind of event group is</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Name</td>
      <td>The short user-readable description of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Outcome</td>
      <td>Displays the outcome, generally "success" or "failure"</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Priority</td>
      <td>The priority of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Receipt Time</td>
      <td>The time at which the event related to the activity was received</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Event Ref Date</td>
      <td>When the issue was first published</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref ID</td>
      <td>Event reference ID (CVE, etc)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref IDS</td>
      <td>Event reference IDs (CVE, OSVDB, etc)</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Event Ref Score</td>
      <td>Score for the Issue (CVSS)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref Score V2</td>
      <td>Score V2 for the Issue (CVSS)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref Score V3</td>
      <td>Score V3 for the Issue (CVSS)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref Source</td>
      <td>Issue Reference Source (CVE etc)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Ref Version</td>
      <td> Issue Reference Source Version (CVE etc)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Severity</td>
      <td>The severity of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Subcategory</td>
      <td>The sub-taxonomy of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Type</td>
      <td>The event type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Event Violation</td>
      <td>The culprit</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Events</td>
      <td>Alarm events summary</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Expires</td>
      <td>Event expires</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>External ID</td>
      <td>An ID used by the originating device</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>File Create Time</td>
      <td>The timestamp of when the file was created</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Hash</td>
      <td>The hash of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Hash Algorithm</td>
      <td>The algorithm used to produce the file hash - SH256 MD5 etc</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Hash Md5</td>
      <td>The MD5 of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Hash Sha1</td>
      <td>The SHA1 of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Hash Sha256</td>
      <td>The SHA256 of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File ID</td>
      <td>The Operating System ID of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File KB Size</td>
      <td>The size in kilobytes of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Modification Time</td>
      <td>The last modification time of a file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Name</td>
      <td>The short name of a file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Create Time</td>
      <td>The previous creation time</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Hash\_algorithm</td>
      <td>The algorithm used to produce the file hash</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Hash</td>
      <td>The previous file hash</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old ID</td>
      <td>The previous ID of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Modification Time</td>
      <td>The previous modification time of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Name</td>
      <td>The previous short file name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Owner</td>
      <td>Old file owner</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Path</td>
      <td>The previous full path of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Permission</td>
      <td>The previous old permissions of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Size</td>
      <td>The previous size of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Old Type</td>
      <td>The previous type of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Owner</td>
      <td>The current owner of a file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Path</td>
      <td>Full path of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Permission</td>
      <td>The OS permissions of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>File Type</td>
      <td>The type of the file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Full Message</td>
      <td>A long message</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Gateway</td>
      <td>Gateway IP addres</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Global List Name</td>
      <td>Name of the Global List</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Global List Value</td>
      <td>Value from the list</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Group Policy</td>
      <td>Group Policy that the event refers to, for example a Active Directory Group Policy</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Has Alarm</td>
      <td>If this event is used by an alarm</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Highlight Fields</td>
      <td>Array of important fields</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>HTML Link</td>
      <td>A specified HTML link address</td>
      <td>URL</td>
    </tr>

    <tr>
      <td>HTML Snippet</td>
      <td>A specified HTML link snippet</td>
      <td>String</td>
    </tr>

    <tr>
      <td>HTML Title</td>
      <td>A specified HTML link title</td>
      <td>String</td>
    </tr>

    <tr>
      <td>HTTP Hostname</td>
      <td>The hostname present in a HTTP connection</td>
      <td>String</td>
    </tr>

    <tr>
      <td>HTTP Referrer</td>
      <td>The HTTP referrer in a HTTP request</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Identity Group Name</td>
      <td>Group name associated with the identity source address to further identify the identity event with Group name resolution</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Identity Host Name</td>
      <td>Host name information associated with the identity source address to further identify the true hostname tied to an event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Identity MAC</td>
      <td>MAC associated with the identity source address to further identify the identity event with MAC resolution</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Identity NetBIOS</td>
      <td>NetBIOS name associated with the identity source address to further identify the identity event with NetBIOS name resolution</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Identity Source Address</td>
      <td>IPv4 or IPv6 address that can connect an event with a true user identify or true computer identity</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>In Alarms</td>
      <td>Array of alarms to which the event belongs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Incident ID</td>
      <td>ID provided by the event source</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Instance IDs </td>
      <td>An array of the instance IDs for the instances being terminated</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Instance Types</td>
      <td>An array of the instance types for the instances being started</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>IOCs</td>
      <td>Array with the matched Indicators of Compromise</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>IP Addresses</td>
      <td>List of IP Addresses</td>
      <td>String Array</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>k8s DNS Policy</td>
      <td>K8S DNS Policy</td>
      <td>String</td>
    </tr>

    <tr>
      <td>k8s Node Name</td>
      <td>K8S Node Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>k8s Priority</td>
      <td>K8S Priority</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Last Updated</td>
      <td>When this item was last updated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Absolute</td>
      <td>Legacy Key: Absolute</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Application</td>
      <td>Legacy Key: Application</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Binary Data</td>
      <td>Legacy Key: Binary Data</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Condition</td>
      <td>Legacy Key: Condition</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy CPU</td>
      <td>Legacy Key: CPU</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy CTX</td>
      <td>Legacy Key: CTX</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Date</td>
      <td>Legacy Key: Date</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Device</td>
      <td>Legacy Key: Device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Domain</td>
      <td>Legacy Key: Domain</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy DST IP</td>
      <td>Legacy Key: Destination IP</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy DST Port</td>
      <td>Legacy Key: Destination Port</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Event ID</td>
      <td>Legacy Key: Event ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Event Type</td>
      <td>Legacy Key: Event Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Extra Data</td>
      <td>Legacy Key: Extra Data</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy FDdate</td>
      <td>Legacy Key: FDate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Filename</td>
      <td>Legacy Key: Filename</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy From</td>
      <td>Legacy Key: From</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy GzipData</td>
      <td>Legacy Key: GzipData</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy HIDS Event Type</td>
      <td>Legacy Key: HIDS event type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Host</td>
      <td>Legacy Key: host</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Hostname</td>
      <td>"Legacy Key: hostname</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Interface</td>
      <td>Legacy Key: interface</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Interval</td>
      <td>Legacy Key: interval</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Inventory Source</td>
      <td>Legacy inventory source</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy IP</td>
      <td>Legacy Key: IP</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy IPv</td>
      <td>Legacy Key: IPv</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Log</td>
      <td>Legacy Key: log</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Login</td>
      <td>Legacy Key: login</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy MAC</td>
      <td>Legacy Key: MAC</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Mail</td>
      <td>Legacy Key: Mail</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Memory</td>
      <td>Legacy Key: Memory</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Occurrences</td>
      <td>Legacy Key: Occurrences</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Organization</td>
      <td>Legacy Key: Organization</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy OS</td>
      <td>Legacy Key: OS</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Password</td>
      <td>Legacy Key: Password</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Plugin ID</td>
      <td>Legacy Key: Plugin ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Plugin SID</td>
      <td>Legacy Key: Plugin SID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Port From</td>
      <td>Legacy Key: Port From</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Port To</td>
      <td>Legacy Key: Port To</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Port </td>
      <td>Legacy Key: Port</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Priority</td>
      <td>Legacy Key: Priority</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Protocol</td>
      <td>Legacy Key: Protocol</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Reliability</td>
      <td>Legacy Key:Reliability</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Sensor ID</td>
      <td>Legacy Key:Sensor ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Sensor</td>
      <td>Legacy Key:Sensor</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Service</td>
      <td>Legacy Key:Service</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Snort CID</td>
      <td>Legacy Key: Snort CID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Snort SID</td>
      <td>Legacy Key: Snort SID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Software</td>
      <td>Legacy Key: Software</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy SRC IP</td>
      <td>Legacy Key: Source IP</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy SRC Port</td>
      <td>Legacy Key: Source Port</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy State</td>
      <td>Legacy Key: State</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Target</td>
      <td>Legacy Key: Target</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy To</td>
      <td>Legacy Key: To</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Type</td>
      <td>Legacy Key: Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Unziplen</td>
      <td>Legacy Key: Unzip Length</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy UserData</td>
      <td>Legacy Key: UserData</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Value</td>
      <td>Legacy Key: Value</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Vendor</td>
      <td>Legacy Key: Vendor</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Legacy Video</td>
      <td>Legacy Key: Video</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Level</td>
      <td>The standard syslog level</td>
      <td>Long</td>
    </tr>

    <tr>
      <td>Log File</td>
      <td>The Log File</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Log </td>
      <td>The raw log used to generate this event</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Malware Family</td>
      <td>Malware Family</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Malware Variant</td>
      <td>Virus or Malware Variant</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Matched Value</td>
      <td>The value that was matched for the enrichment metadata</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Mute Alarm</td>
      <td>Mute alarm</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Needs Enrichment</td>
      <td>If the event needs to be enriched</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Needs Internal Enrichment</td>
      <td>If the event needs to be enriched with internal fields</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>New Basic Constraints</td>
      <td>New Basic Constraints</td>
      <td>String</td>
    </tr>

    <tr>
      <td>New Certificate</td>
      <td>New Certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>New IP</td>
      <td>New IP</td>
      <td>String</td>
    </tr>

    <tr>
      <td>New Issuer</td>
      <td>New Issuer</td>
      <td>String</td>
    </tr>

    <tr>
      <td>New Subject</td>
      <td>New Subject</td>
      <td>String</td>
    </tr>

    <tr>
      <td>New Value</td>
      <td>The new value in the field, after it was modified</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Num Containers</td>
      <td>Number of Containers</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Object ID</td>
      <td>The ID of the Object in AssetDB</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Object Type</td>
      <td>The object type of the source (if applies)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Old Basic Constraints</td>
      <td>Old basic constraints</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Old Certificate</td>
      <td>Old certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Old IP</td>
      <td>Old IP</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Old issue</td>
      <td>Old issue</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Old NS</td>
      <td>Old NS</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Old subject</td>
      <td>Old subject</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Operating System</td>
      <td>Operating System</td>
      <td>String</td>
    </tr>

    <tr>
      <td>OTX activities</td>
      <td>OTX activities</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Package Architecture</td>
      <td>The architecture of the package</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Package Name</td>
      <td>The name of the package</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Package Revision</td>
      <td>The revision of the package</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Package Source</td>
      <td>The source of the package</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Package Version</td>
      <td>The version of the package</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Packet Data</td>
      <td>The binary packet data of the event</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Packet Payload</td>
      <td>Packet payload information from Network IDS</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Packet Type</td>
      <td>What type of packet this is</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Packets Received</td>
      <td>The number of packets received</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Packets Sent</td>
      <td>The number of packets sent</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Patch Reference ID</td>
      <td>Patch reference id (Oval rule, etc)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Patch Vulnerability Reference List</td>
      <td>List of reference ID's (CVE, etc) for the patch event</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Peak PPS</td>
      <td>Packets per second (PPS) peak value</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Pefile Company</td>
      <td>The company field on a PE32 executable file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Pefile Description</td>
      <td>he description field on a PE32 executable file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Pefile Fileversion</td>
      <td>The fileversion field on a PE32 executable file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Pefile Product</td>
      <td>The product field on a PE32 executable file</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Device Type </td>
      <td>The type of the device this plugin was made for</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Device Version</td>
      <td>The version of the device this plugin was made for</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Device </td>
      <td>Plugin Device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Family</td>
      <td>Plugin Family</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Parent</td>
      <td>Parent which was used to normalize event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Rule</td>
      <td>Plugin Rule</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Vendor</td>
      <td>The vendor of the device this plugin was made for</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin Version</td>
      <td>Plugin Version</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Plugin</td>
      <td>Plugin used to normalize event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Policy</td>
      <td>Policy that the event refers to, for example a Firewall or Content Filtering Policy</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Policy Address</td>
      <td>Address referenced on a db policy firewall rule etc</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Policy Interface</td>
      <td>Network Interface referenced on a db policy firewall rule etc</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Policy Mac</td>
      <td>Mac address referenced on a db policy firewall rule etc</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Pre\_authentication Type</td>
      <td>The method used be the user to pre-authenticate, RSA Key, Password, Domain Credentials</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Previous Value</td>
      <td>The value present in the field, before it was modified</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Priority Label</td>
      <td>Priority label of Alarm</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Priority</td>
      <td>Priority of Alarm</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Project ID</td>
      <td>Project ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Protocol Version</td>
      <td>Version of the current protocol</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Realm</td>
      <td>Realm where the user roles and permissions apply</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Received From</td>
      <td>Source this event was received from</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Registry Path</td>
      <td>The registry path</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Registry Value</td>
      <td>The registry value</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Relative Distinguished Name</td>
      <td> The name of the authentication package used</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Canonical </td>
      <td>Reporting Device Canonical Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Address</td>
      <td>Reporting device address</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Rep Device Address 6</td>
      <td>Reporting device address version 6</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rep Device Asset ID</td>
      <td>Instance ID for reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rep Device FQDN</td>
      <td>Reporting device FQDN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Hostname</td>
      <td>Reporting device hostname</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Inbound Interface</td>
      <td>The network interface receiving the traffic generating the event on the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Instance ID</td>
      <td>Instance ID for the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rep Device Location ID</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rep Device Location Name</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device MAC</td>
      <td>Reporting device MAC</td>
      <td>MAC</td>
    </tr>

    <tr>
      <td>Reporting Device Model</td>
      <td>The model of the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Outbound Interface</td>
      <td>The network interface passing through the traffic generating the event on the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Rule ID</td>
      <td>The ID of the rule used by the reporting device to generate this event (ie firewall rule, CVE, IDS rule</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Type</td>
      <td>The device type of the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Vendor</td>
      <td>The vendor of the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reporting Device Version</td>
      <td>The version of the reporting device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Category</td>
      <td>The category of the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Database Index</td>
      <td>The database index to get the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Database</td>
      <td>The database in which the report has been executed</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Date</td>
      <td>When the report was executed</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Report Executed Format</td>
      <td>The format we use to run the save the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Key</td>
      <td>The executed report's key</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Parameters</td>
      <td>The parameters used to run the query</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed Query </td>
      <td>The query executed to fill the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed rsql Query </td>
      <td>The rsql query executed to fill the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed State</td>
      <td>The search state</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed User</td>
      <td>User who run the report</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Report Executed UUID</td>
      <td>The executed report's uuid. Unique identifier</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Reputation Score</td>
      <td>Risk or reputation score for a host</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request Content Type</td>
      <td>The content type for the request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request Cookies</td>
      <td>The cookies passed in a HTTP request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request HTTP Version</td>
      <td>HTTP version for the request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request Method</td>
      <td>The HTTP request method - OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request Referrer </td>
      <td>Referrer for the request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request URL </td>
      <td>The URL reference in a HTTP request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Request User Agent</td>
      <td>User agent for the request</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Resource Provider</td>
      <td>Provider of resource</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Resource URI</td>
      <td>URI representing a resource uniquely</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Response Code</td>
      <td>The response code for the request</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Response Content Type</td>
      <td>HTTP response content type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Return Value</td>
      <td>Return value</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Role</td>
      <td>Role or roles of the user in the organization</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule  Attack ID</td>
      <td>Correlation Rule Attack ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule  Attack Tactic</td>
      <td>Array of Correlation Rule Attack Tactics</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Rule  Attack Technique</td>
      <td>Correlation Rule Attack Technique</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule Dictionary</td>
      <td>Rule Dictionary</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule ID</td>
      <td>Correlation Rule ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule Intent</td>
      <td>Alarm Intent</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule Method</td>
      <td>Alarm Method</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule Name</td>
      <td>Correlation Rule Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule Strategy</td>
      <td>Alarm Strategy</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Rule UUID</td>
      <td>Rule ID which triggered event</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>S3 Notification</td>
      <td>S3 notification</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Scheduled Task ID </td>
      <td>The ID of the Scheduled task</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Searched Site</td>
      <td>Site searched</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Security Group ID</td>
      <td>Security Group ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Security Group Name</td>
      <td>Security Group Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Sensor App Action</td>
      <td>The Sensor App Action Called</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Sensor Event Rate</td>
      <td>The value of the sensor event rate</td>
      <td>Double</td>
    </tr>

    <tr>
      <td>Sensor Name</td>
      <td>The name of the sensor that received this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Sensor UUID </td>
      <td>The UUID of the sensor that received this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Session</td>
      <td>Session Identifier</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Shared Resource Name</td>
      <td>The name of the shared resource</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Short Message</td>
      <td>A short descriptive message</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Silent </td>
      <td>Silent alarm</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Source Account ID</td>
      <td>Source user account in the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Account Name </td>
      <td>Source account name where the event was generated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Account</td>
      <td>Source Account where the event was generated</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Additional Hostnames</td>
      <td>Source additional hostnames</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Source Address</td>
      <td>Source IP Address</td>
      <td>IP </td>
    </tr>

    <tr>
      <td>Source Address 6</td>
      <td>Source IP Address in v6 format</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source ASN</td>
      <td>Source ASN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Asset ID</td>
      <td>This is an internal field used to associate this event with a particular asset</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Blacklist Activity </td>
      <td>Observed activity of the IP address to cause it to be put into OTX</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Blacklist Priority</td>
      <td>OTX priority</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Blacklist Reliability</td>
      <td>OTX reliability</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Canonical </td>
      <td>Canonical Source</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source City</td>
      <td>Source City</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Country</td>
      <td>Source Country</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source CPE</td>
      <td>Source CPE</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Datacenter</td>
      <td>Source data center</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Datastore</td>
      <td>Source data store</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source DNS Domain</td>
      <td>The DNS domain part of the complete fully qualified domain name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source FQDN</td>
      <td>Source FQDN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Hostname</td>
      <td>Source hostname</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Infrastructure Name</td>
      <td>Source Infrastructure Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Infrastructure Type</td>
      <td>Source Infrastructure Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Instance ID</td>
      <td>Instance ID for source device</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Latitude</td>
      <td>Source Latitude</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Location ID</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Location Name</td>
      <td>This is an internal field used to associate this event with a particular location</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Longitude</td>
      <td>Source Longitude</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source MAC</td>
      <td>Source MAC Address</td>
      <td>MAC</td>
    </tr>

    <tr>
      <td>Source MAC Vendor</td>
      <td>Source MAC Vendor</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Name</td>
      <td>Source Name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source NAT Address</td>
      <td>Source NAT IP Address</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Source NAT Port</td>
      <td>Source NAT Port</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Source Netmask</td>
      <td>Source IP Address mask</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Source Network</td>
      <td>Source network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source NT Domain</td>
      <td>Source Windows Domain</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Organisation</td>
      <td>Source Organisation</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Port Label</td>
      <td>Source Port Label</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Port</td>
      <td>Source Port</td>
      <td>Port</td>
    </tr>

    <tr>
      <td>Source Post Nat Address</td>
      <td>Source address for the event message after NAT occurred</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Source Post Nat Port</td>
      <td>Port number of the event source after NAT</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Source Pre Nat Address</td>
      <td>Source address for the event message before NAT</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Source Pre Nat Port</td>
      <td>Port number of the event source before NAT</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Source Process</td>
      <td>Source Process name</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process Command Line</td>
      <td>The Process Command line</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process ID</td>
      <td>Source Process ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process Parent</td>
      <td>The Process Parent</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process Parent Commandline</td>
      <td>The Parent Command Line</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process Parent Process ID</td>
      <td>The Parent Process ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Process User</td>
      <td>Source Process User</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Region</td>
      <td>Source Region</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Registered Country</td>
      <td>Source Registered Country</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Service Name</td>
      <td>The service which is responsible for generating this event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Translated Address</td>
      <td>Identifies the translated source address that the event refers to in an IP network</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Source Translated Port</td>
      <td>Port after it was translated</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Source User Email Domain</td>
      <td>Source user email domain</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source User Email</td>
      <td>Source user email</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source User Group</td>
      <td>The source user group</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source User ID</td>
      <td>Source user in the system</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source User Privileges</td>
      <td>Source Users privileges</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source User ID</td>
      <td>Source User ID</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Username</td>
      <td>Source username</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Vguest</td>
      <td>Source virtual guest</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Vhost</td>
      <td>Source virtual host</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source VPC</td>
      <td>Source VPC</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source VPN</td>
      <td>Source VPN</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Workstation</td>
      <td>Source Workstation</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source Zone</td>
      <td>Source Zone</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Source </td>
      <td>Source - This is compared against several known formats to extract relevant data e.g. \<hostname>:\<port>:\<zone> etc.</td>
      <td>Network Info</td>
    </tr>

    <tr>
      <td>Sources</td>
      <td>List of source asset IDs</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>SSH Authorized Key</td>
      <td>The SSH authorized key</td>
      <td>String</td>
    </tr>

    <tr>
      <td>SSH Client Proto</td>
      <td>Identifies the SSH client protocol</td>
      <td>String</td>
    </tr>

    <tr>
      <td>SSH Client Software</td>
      <td>Identifies the SSH client software</td>
      <td>String</td>
    </tr>

    <tr>
      <td>SSH Server Proto</td>
      <td>Identifies the SSH server protocol</td>
      <td>String</td>
    </tr>

    <tr>
      <td>SSH Server Software</td>
      <td>Identifies the SSH server software</td>
      <td>String</td>
    </tr>

    <tr>
      <td>SSH Server Version</td>
      <td>Identifies the SSH server version</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Stat Name</td>
      <td>The name of the stat that has exceeded its threshold</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Stat Value</td>
      <td>The value of the stat that has exceeded its threshold</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Subcategory ID</td>
      <td>The ID of the sub-taxonomy of the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Suppress Rule ID</td>
      <td>ID of the rule that suppressed this log</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Suppress Rule Name</td>
      <td>Name of the rule that suppressed this log</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Suppressed</td>
      <td>If event is suppressed</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Syslog Source </td>
      <td>The source channel a syslog-ng event came from</td>
      <td>String</td>
    </tr>

    <tr>
      <td>System Event Type</td>
      <td>The system event type generated</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Tag</td>
      <td>The syslog tag (the data found before the \[] after the timestamp)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Threat Intelligence Feed Name</td>
      <td>Array with the  name of the feeds that the pulse has matched</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Threat Intelligence Matched Metadata</td>
      <td>Array with tuples of metadata</td>
      <td>String Array</td>
    </tr>

    <tr>
      <td>Ticket Encryption Type</td>
      <td>The ticket encryption type used</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Time End</td>
      <td>The ending time of the event, such as a file download</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Time Offset </td>
      <td>The time offset the event occurred in</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Time Start</td>
      <td>The starting time of the event, such as a file download</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Time Zone</td>
      <td>The timezone the event occurred in</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Timestamp Arrived</td>
      <td>The approximated time that the event arrived to the customer control node</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Timestamp End</td>
      <td>Process end timestamp</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Timestamp Occurred</td>
      <td>The time that the event occurred - will be set by default if not populated</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Timestamp Received</td>
      <td>When the event was received by the system</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Timestamp Start</td>
      <td>Process start timestamp</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>Timestamp </td>
      <td>The approximated time that the event is sent from the control node to hot storage</td>
      <td>Date</td>
    </tr>

    <tr>
      <td>TLS Cipher</td>
      <td>The cipher algorithm used for this TLS connection</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TLS Fingerprint</td>
      <td>Identifies the SHA1 fingerprint of the certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TLS IssuerDN</td>
      <td>Identifies the issuer DN of certificate</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TLS SNI</td>
      <td>Identifies the server name indication sent by a client</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TLS Subject</td>
      <td>Identifies the subject of the TLS protocol</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TLS Version</td>
      <td>Identifies the version of TLS protocol</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Total Disconnection Time</td>
      <td>Total time the monitored asset has stopped sending data</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Total Packets</td>
      <td>The total number of packets transmitted</td>
      <td>Integer</td>
    </tr>

    <tr>
      <td>Transaction Status</td>
      <td>Transaction status</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Transient</td>
      <td>Is the event transient</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Transport Protocol</td>
      <td>Layer-4 protocol observed in the event (e.g. TCP, UDP)</td>
      <td>String</td>
    </tr>

    <tr>
      <td>TTY Terminal</td>
      <td>The TTY referenced in the event</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Used Hint</td>
      <td>If a hint was used to find the plugin</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>User Group ID</td>
      <td>Group ID that is associated with the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Policy</td>
      <td>Policy associated with the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Realm</td>
      <td>Portal name associated with the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Resource Type</td>
      <td>User Resource Type</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Resource</td>
      <td>Resource associated with the user account</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Role</td>
      <td>Role type associated with the user account that created the event</td>
      <td>String</td>
    </tr>

    <tr>
      <td>User Type</td>
      <td>The type of user account. Example: Local, special, etc.</td>
      <td>String</td>
    </tr>

    <tr>
      <td>UUID</td>
      <td>The unique ID for this Event</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Virtual Source Address</td>
      <td>IP address of the virtual event source</td>
      <td>IP</td>
    </tr>

    <tr>
      <td>Virtual Source Name</td>
      <td>Name of the virtual event source</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Was Fuzzied</td>
      <td>If fuzzied parser was used to generate the event</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>Was Guessed</td>
      <td>If we brute forced the plugin</td>
      <td>Boolean</td>
    </tr>

    <tr>
      <td>was\_legacy</td>
      <td>Legacy Key: Was Legacy</td>
      <td>String</td>
    </tr>

    <tr>
      <td>watchlist</td>
      <td>Array with matched watchlists</td>
      <td>Array </td>
    </tr>

    <tr>
      <td>Wireless Access Point</td>
      <td>The access point of the wireless network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Wireless BSSID</td>
      <td>The BSSID of the wireless network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Wireless Channel</td>
      <td>The channel of the wireless network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Wireless Encryption</td>
      <td>The encryption mechanism used by the wireless network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>Wireless SSID</td>
      <td>The SSID of the wireless network</td>
      <td>String</td>
    </tr>

    <tr>
      <td>WMI Class</td>
      <td>WMI Class</td>
      <td>String</td>
    </tr>

    <tr>
      <td>WMI Consumer</td>
      <td>WMI Consumer</td>
      <td>String</td>
    </tr>

    <tr>
      <td>WMI Filter</td>
      <td>WMI Filter</td>
      <td>String</td>
    </tr>

    <tr>
      <td>WMI Path</td>
      <td>WMI Path</td>
      <td>String</td>
    </tr>
  </tbody>
</table>

<table>
  <thead>
    <tr>
      <th>Event Key</th>
      <th>Definition</th>
      <th>Type</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Yara Signature</td>
      <td>Yara Signatures</td>
      <td>String Array</td>
    </tr>
  </tbody>
</table>