{ "registry_version": 22, "schema_version": 1, "roles": { "source": { "cardinality": "one", "types": [ "user", "account", "host", "endpoint", "process", "file", "service", "resource", "application", "cloud", "container" ] }, "carriers": { "cardinality": "many", "types": [ "process", "file", "script", "application", "service", "resource", "container" ] }, "target": { "cardinality": "one", "types": [ "user", "account", "host", "endpoint", "process", "file", "service", "domain", "url", "resource", "application", "cloud", "container" ] }, "observer": { "cardinality": "one", "types": [ "product", "device", "host", "service", "application", "resource", "cloud", "container" ] }, "related": { "cardinality": "many", "types": [ "user", "account", "host", "endpoint", "process", "file", "service", "domain", "url", "device", "resource", "application", "cloud", "container", "certificate" ] } }, "array_reference": { "field": "ref_id", "scope": "event", "pattern": "^[a-z][a-z0-9_-]{0,63}$", "unique_within": "event", "physical_indexes": [ "role_index", "peer_index", "relation_index" ], "physical_indexes_are_identity": false }, "facet_domains": [ "network", "application", "http", "database", "email", "container", "dns", "process", "tls", "authentication", "file_activity", "registry", "cloud", "ot" ], "logical_paths": [ "metadata.tenant_id", "metadata.occur_time", "metadata.ingest_time", "metadata.event_id", "metadata.parse_time", "metadata.schema_version", "metadata.mapping_id", "metadata.data_source.vendor", "metadata.data_source.product", "metadata.data_source.category", "metadata.data_source.instance_id", "metadata.log.type", "metadata.log.level", "metadata.log.name", "metadata.log_id", "event.record_kind", "event.domain", "event.type", "event.operation", "event.outcome", "event.severity", "event.message", "roles.source.endpoint.ip", "roles.source.endpoint.ipv4", "roles.source.endpoint.ipv6", "roles.source.endpoint.port", "roles.source.endpoint.mac", "roles.source.host.mac", "roles.source.user.name", "roles.source.account.name", "roles.source.host.name", "roles.source.host.id", "roles.source.process.name", "roles.source.process.pid", "roles.source.process.uid", "roles.source.process.path", "roles.source.process.cmdline", "roles.source.process.user.name", "roles.source.process.file.hashes.md5", "roles.source.process.file.hashes.sha1", "roles.source.process.file.original_name", "roles.source.process.file.internal_name", "roles.source.process.file.signatures[].signer", "roles.source.geo.city.name", "roles.source.geo.continent.name", "roles.source.geo.country.code", "roles.source.endpoint.device.type", "roles.source.geo.country.name", "roles.source.geo.region.name", "roles.source.geo.coordinates.latitude", "roles.source.geo.coordinates.longitude", "roles.source.host.os.type", "roles.carriers[].process.name", "roles.carriers[].process.pid", "roles.carriers[].process.uid", "roles.carriers[].process.guid", "roles.carriers[].process.cmdline", "roles.carriers[].process.path", "roles.carriers[].process.created_time", "roles.carriers[].process.user.name", "roles.carriers[].process.user.id", "roles.carriers[].process.file.hashes.md5", "roles.carriers[].process.file.hashes.sha1", "roles.carriers[].process.file.hashes.sha256", "roles.carriers[].process.file.original_name", "roles.carriers[].process.file.internal_name", "roles.carriers[].process.file.company_name", "roles.carriers[].process.file.product.name", "roles.carriers[].process.file.description", "roles.carriers[].process.file.version", "roles.carriers[].process.file.signatures[].signer", "roles.carriers[].process.file.signatures[].status", "roles.carriers[].script.id", "roles.carriers[].script.language", "roles.carriers[].script.command", "roles.carriers[].script.content", "roles.target.endpoint.ip", "roles.target.endpoint.ipv4", "roles.target.endpoint.ipv6", "roles.target.endpoint.port", "roles.target.endpoint.mac", "roles.target.user.name", "roles.target.host.name", "roles.target.host.id", "roles.target.host.mac", "roles.target.host.os.name", "roles.target.host.os.type", "roles.target.service.name", "roles.target.service.port", "roles.target.domain.name", "roles.target.url.full", "roles.target.geo.city.name", "roles.target.geo.continent.name", "roles.target.geo.country.code", "roles.target.geo.country.name", "roles.target.geo.region.name", "roles.target.geo.coordinates.latitude", "roles.target.geo.coordinates.longitude", "roles.target.file.path", "roles.target.file.name", "roles.target.file.size", "roles.target.file.mime_type", "roles.target.file.created_time", "roles.target.file.hashes.md5", "roles.target.file.hashes.sha1", "roles.target.file.hashes.sha256", "roles.target.process.name", "roles.target.process.pid", "roles.target.process.uid", "roles.target.process.path", "roles.target.process.cmdline", "roles.target.process.created_time", "roles.target.process.working_directory", "roles.target.process.integrity", "roles.target.process.terminated_time", "roles.target.process.tree_info", "roles.target.process.user.name", "roles.target.process.user.id", "roles.target.process.user.session_id", "roles.target.process.file.hashes.md5", "roles.target.process.file.hashes.sha1", "roles.target.process.file.hashes.sha256", "roles.target.process.file.original_name", "roles.target.process.file.internal_name", "roles.target.process.file.company_name", "roles.target.process.file.product.name", "roles.target.process.file.description", "roles.target.process.file.version", "roles.target.process.file.signatures[].signer", "roles.target.process.file.signatures[].status", "roles.target.file.hashes.value", "roles.target.service.id", "roles.observer.product.name", "roles.observer.device.id", "roles.observer.device.name", "roles.observer.device.vendor", "roles.observer.device.type", "roles.observer.device.serial_number", "roles.observer.device.ip", "roles.observer.device.ipv4", "roles.observer.device.ipv6", "roles.observer.device.ip_addresses[].address", "roles.observer.device.model", "roles.observer.type", "roles.related[].ref_id", "roles.related[].entity_type", "roles.related[].relation_type", "roles.related[].is_primary", "roles.related[].endpoint.ip", "roles.related[].endpoint.ipv4", "roles.related[].endpoint.ipv6", "roles.related[].endpoint.port", "roles.related[].endpoint.mac", "roles.related[].user.name", "roles.related[].user.uid", "roles.related[].user.domain", "roles.related[].account.name", "roles.related[].host.name", "roles.related[].host.id", "roles.related[].host.ip", "roles.related[].host.ipv4", "roles.related[].host.ipv6", "roles.related[].host.os.name", "roles.related[].host.os.type", "roles.related[].host.os.version", "roles.related[].process.name", "roles.related[].process.pid", "roles.related[].process.uid", "roles.related[].process.path", "roles.related[].process.cmdline", "roles.related[].process.file.hashes.md5", "roles.related[].process.file.original_name", "roles.related[].process.file.internal_name", "roles.related[].process.file.signatures[].signer", "roles.related[].file.path", "roles.related[].file.name", "roles.related[].file.size", "roles.related[].file.mime_type", "roles.related[].file.created_time", "roles.related[].file.modified_time", "roles.related[].file.hashes.md5", "roles.related[].file.hashes.sha1", "roles.related[].file.hashes.sha256", "roles.related[].service.name", "roles.related[].service.id", "roles.related[].service.port", "roles.related[].domain.name", "roles.related[].url.full", "facets.email.recipients[]", "facets.email.attachments[].name", "facets.network.protocol", "facets.network.direction", "facets.network.session_id", "facets.network.nat.original.ip", "facets.network.nat.original.ipv4", "facets.network.nat.original.ipv6", "facets.network.nat.translated.ip", "facets.network.nat.translated.ipv4", "facets.network.nat.translated.ipv6", "facets.application.name", "facets.http.request.method", "facets.http.response.status_code", "facets.http.request.host", "facets.http.request.forwarded_for[].ip", "facets.container.kubernetes.namespace", "facets.container.kubernetes.pod.name", "facets.container.kubernetes.pod.id", "facets.container.kubernetes.cluster.id", "facets.container.kubernetes.cluster.name", "facets.container.kubernetes.container.id", "facets.container.kubernetes.container.name", "facets.dns.question.name", "facets.dns.question.type", "facets.dns.answers[].address", "facets.dns.response.code", "facets.process.injection.method", "facets.process.injection.target_thread.id", "facets.process.injection.target_thread.address", "facets.process.injection.target_thread.arguments", "facets.process.injection.target_thread.module_path", "facets.registry.key.path", "facets.registry.key.renamed_path", "facets.registry.value.name", "facets.registry.value.type", "facets.registry.value.previous.data", "facets.registry.value.previous.size", "facets.registry.value.current.data", "facets.registry.value.current.size", "facets.email.sender", "facets.email.subject", "facets.http.client.browser.type", "facets.http.request.cdn.endpoints[].ip", "facets.http.request.cdn.endpoints[].ipv4", "facets.http.request.cdn.endpoints[].ipv6", "facets.http.request.headers", "facets.http.request.query", "facets.http.request.referer", "facets.http.request.user_agent", "facets.http.response.headers", "facets.network.intermediaries", "facets.network.intermediaries[].ip", "facets.network.protocol.code", "facets.network.traffic.total_bytes", "facets.network.traffic.total_packets", "facets.network.zone.name", "source_finding.title", "source_finding.severity", "source_finding.original_severity", "source_finding.category", "source_finding.category.original.code", "source_finding.category.original.name", "source_finding.category.normalized.level1.code", "source_finding.category.normalized.level1.name", "source_finding.category.normalized.level2.code", "source_finding.category.normalized.level2.name", "source_finding.description", "source_finding.status", "source_finding.count", "source_finding.behavior", "source_finding.killchain", "source_finding.detection_method", "source_finding.remediation", "source_finding.compromise_status", "source_finding.attack_result", "source_finding.attacker.endpoint.ip", "source_finding.attacker.endpoint.ipv4", "source_finding.attacker.endpoint.ipv6", "source_finding.attacker.endpoint.port", "source_finding.attacker.geo.continent.name", "source_finding.attacker.geo.country.code", "source_finding.attacker.geo.country.name", "source_finding.attacker.geo.region.name", "source_finding.attacker.geo.city.name", "source_finding.attacker.geo.coordinates.latitude", "source_finding.attacker.geo.coordinates.longitude", "source_finding.attacker.resource.id", "source_finding.attacker.resource.name", "source_finding.attacker.resource.type", "source_finding.attacker.resource.system.id", "source_finding.attacker.resource.system.name", "source_finding.attacker.resource.organization.name", "source_finding.victim.endpoint.ip", "source_finding.victim.endpoint.ipv4", "source_finding.victim.endpoint.ipv6", "source_finding.victim.geo.continent.name", "source_finding.victim.geo.country.code", "source_finding.victim.geo.country.name", "source_finding.victim.geo.region.name", "source_finding.victim.geo.city.name", "source_finding.victim.geo.coordinates.latitude", "source_finding.victim.geo.coordinates.longitude", "source_finding.victim.resource.id", "source_finding.victim.resource.name", "source_finding.victim.resource.type", "source_finding.victim.resource.system.id", "source_finding.victim.resource.system.name", "source_finding.victim.resource.organization.name", "source_finding.attack_direction", "source_finding.malware.name", "source_finding.malware.type", "source_finding.malware.family_id", "source_finding.rule.signature_id", "source_finding.rule.id", "source_finding.rule.label", "source_finding.rule.policy_id", "source_finding.action", "source_finding.original_id", "source_finding.ioc.value", "source_finding.evidence.match.value", "source_finding.mitre.technique_id", "source_finding.vulnerability.cve", "source_finding.vulnerability.id", "source_finding.action.code", "source_finding.affected_platform", "source_finding.attention.content", "source_finding.attention.type", "source_finding.campaign", "source_finding.category_code", "source_finding.category_level2", "source_finding.category_level2_code", "source_finding.confidence", "source_finding.duration", "source_finding.entities.attackers[].endpoint.ip", "source_finding.entities.attackers[].ref_id", "source_finding.entities.attackers[].entity_type", "source_finding.entities.victims[].ref_id", "source_finding.entities.victims[].entity_type", "source_finding.entities.affected[].ref_id", "source_finding.entities.affected[].entity_type", "source_finding.indicators[].id", "source_finding.indicators[].type", "source_finding.indicators[].value", "source_finding.indicators[].status", "source_finding.indicators[].source", "source_finding.indicators[].confidence", "source_finding.rules[].id", "source_finding.rules[].signature_id", "source_finding.rules[].name", "source_finding.rules[].version", "source_finding.rules[].policy_id", "source_finding.rules[].policy_name", "source_finding.rules[].status", "source_finding.evidence.http.location.code", "source_finding.evidence.http.location.name", "source_finding.evidence.http.matched_content", "source_finding.evidence.match.length", "source_finding.evidence.match.offset", "source_finding.file.hash_type", "source_finding.hit_count", "source_finding.ioc.id", "source_finding.ioc.source", "source_finding.ioc.status", "source_finding.ioc.type", "source_finding.is_attack_alert", "source_finding.malware.family", "source_finding.malware.family_label", "source_finding.metrics.attack_bytes", "source_finding.metrics.attack_packets", "source_finding.mitre.tactics", "source_finding.mitre.techniques", "source_finding.original_category", "source_finding.original_category_code", "source_finding.original_killchain", "source_finding.protection.type.code", "source_finding.protection.type.name", "source_finding.published_time", "source_finding.rule.item_id", "source_finding.rule.policy_name", "source_finding.rule.status", "source_finding.rule.version", "source_finding.targeted_attack", "source_finding.threshold.unit", "source_finding.threshold.value", "source_finding.validity_evidence", "source_finding.victim.type", "source_finding.vulnerability.cnnvd", "source_finding.vulnerability.description", "source_finding.vulnerability.impact", "source_finding.vulnerability.name", "source_finding.vulnerability.remediation", "source_finding.vulnerability.type", "source_finding.weak_password", "facets.network.nat.original.source.ip", "facets.network.nat.original.source.port", "facets.network.nat.original.target.ip", "facets.network.nat.original.target.port", "facets.network.nat.translated.source.ip", "facets.network.nat.translated.source.port", "facets.network.nat.translated.target.ip", "facets.network.nat.translated.target.port", "roles.source.user.uid", "roles.target.user.uid", "roles.source.user.domain", "roles.target.user.domain", "facets.authentication.auth_type", "facets.authentication.auth_result", "facets.authentication.auth_failure_reason", "facets.authentication.session_id", "facets.network.application_protocol", "facets.network.connection_state", "roles.target.file.owner.id", "roles.target.file.owner.name", "roles.target.file.group.id", "roles.target.file.group.name", "roles.target.file.permission.mode", "roles.target.file.directory", "roles.target.file.extension", "roles.target.file.modified_time", "roles.source.host.ip", "roles.source.host.ipv4", "roles.source.host.ipv6", "roles.target.host.ip", "roles.target.host.ipv4", "roles.target.host.ipv6", "facets.email.from", "facets.email.attachments[].hashes.md5", "facets.email.attachments[].hashes.sha256", "roles.target.account.name", "roles.observer.device.os.name", "roles.observer.device.os.type", "roles.observer.device.os.version", "roles.source.host.os.version", "roles.target.host.os.version", "facets.email.cc", "facets.email.message_id", "roles.source.host.os.name", "roles.source.resource.id", "roles.source.resource.name", "roles.source.resource.type", "roles.source.resource.subtype", "roles.source.resource.vendor", "roles.source.resource.product", "roles.source.resource.external_id", "roles.source.resource.group.id", "roles.source.resource.group.name", "roles.source.resource.system.id", "roles.source.resource.system.name", "roles.source.resource.organization.id", "roles.source.resource.organization.name", "roles.carriers[].resource.id", "roles.carriers[].resource.name", "roles.carriers[].resource.type", "roles.carriers[].resource.subtype", "roles.carriers[].resource.vendor", "roles.carriers[].resource.product", "roles.carriers[].resource.external_id", "roles.carriers[].resource.group.id", "roles.carriers[].resource.group.name", "roles.target.resource.id", "roles.target.resource.name", "roles.target.resource.type", "roles.target.resource.subtype", "roles.target.resource.vendor", "roles.target.resource.product", "roles.target.resource.external_id", "roles.target.resource.group.id", "roles.target.resource.group.name", "roles.target.resource.system.id", "roles.target.resource.system.name", "roles.target.resource.organization.id", "roles.target.resource.organization.name", "roles.observer.resource.id", "roles.observer.resource.name", "roles.observer.resource.type", "roles.observer.resource.subtype", "roles.observer.resource.vendor", "roles.observer.resource.product", "roles.observer.resource.external_id", "roles.observer.resource.group.id", "roles.observer.resource.group.name", "roles.related[].resource.id", "roles.related[].resource.name", "roles.related[].resource.type", "roles.related[].resource.subtype", "roles.related[].resource.vendor", "roles.related[].resource.product", "roles.related[].resource.external_id", "roles.related[].resource.group.id", "roles.related[].resource.group.name", "source_finding.window.start_time", "source_finding.window.end_time", "source_finding.window.duration_ms", "facets.network.scan.type", "facets.network.scan.method", "facets.network.scan.ports[]", "facets.network.scan.port_count", "facets.network.scan.target_count", "facets.network.scan.interval_ms", "facets.network.traffic.bytes_in", "facets.network.traffic.bytes_out", "facets.network.traffic.packets_in", "facets.network.traffic.packets_out", "facets.network.traffic.rate.value", "facets.network.traffic.rate.unit", "facets.network.traffic.interval_ms", "roles.related[].device.id", "roles.related[].device.name", "roles.related[].device.type", "roles.related[].device.vendor", "roles.related[].device.model", "roles.related[].device.serial_number", "roles.related[].device.instance_path", "roles.related[].device.vendor_id", "roles.related[].device.product_id" ] }