in src/Elastic.CommonSchema/PropDispatch.Generated.cs [655:2877]
internal static bool TrySet(EcsDocument document, string path, object value)
{
switch (path)
{
case "@timestamp":
case "Timestamp":
case "message":
case "Message":
case "span.id":
case "SpanId":
case "trace.id":
case "TraceId":
case "transaction.id":
case "TransactionId":
return TrySetEcsDocument(document, path, value);
case "agent.build.original":
case "AgentBuildOriginal":
case "agent.ephemeral_id":
case "AgentEphemeralId":
case "agent.id":
case "AgentId":
case "agent.name":
case "AgentName":
case "agent.type":
case "AgentType":
case "agent.version":
case "AgentVersion":
return TrySetAgent(document, path, value);
case "as.number":
case "AsNumber":
case "as.organization.name":
case "AsOrganizationName":
return TrySetAs(document, path, value);
case "client.address":
case "ClientAddress":
case "client.bytes":
case "ClientBytes":
case "client.domain":
case "ClientDomain":
case "client.ip":
case "ClientIp":
case "client.mac":
case "ClientMac":
case "client.nat.ip":
case "ClientNatIp":
case "client.nat.port":
case "ClientNatPort":
case "client.packets":
case "ClientPackets":
case "client.port":
case "ClientPort":
case "client.registered_domain":
case "ClientRegisteredDomain":
case "client.subdomain":
case "ClientSubdomain":
case "client.top_level_domain":
case "ClientTopLevelDomain":
case "client.as.number":
case "ClientAsNumber":
case "client.as.organization.name":
case "ClientAsOrganizationName":
case "client.geo.city_name":
case "ClientGeoCityName":
case "client.geo.continent_code":
case "ClientGeoContinentCode":
case "client.geo.continent_name":
case "ClientGeoContinentName":
case "client.geo.country_iso_code":
case "ClientGeoCountryIsoCode":
case "client.geo.country_name":
case "ClientGeoCountryName":
case "client.geo.location":
case "ClientGeoLocation":
case "client.geo.name":
case "ClientGeoName":
case "client.geo.postal_code":
case "ClientGeoPostalCode":
case "client.geo.region_iso_code":
case "ClientGeoRegionIsoCode":
case "client.geo.region_name":
case "ClientGeoRegionName":
case "client.geo.timezone":
case "ClientGeoTimezone":
case "client.user.domain":
case "ClientUserDomain":
case "client.user.email":
case "ClientUserEmail":
case "client.user.full_name":
case "ClientUserFullName":
case "client.user.hash":
case "ClientUserHash":
case "client.user.id":
case "ClientUserId":
case "client.user.name":
case "ClientUserName":
case "client.user.group.domain":
case "ClientUserGroupDomain":
case "client.user.group.id":
case "ClientUserGroupId":
case "client.user.group.name":
case "ClientUserGroupName":
case "client.user.risk.calculated_level":
case "ClientUserRiskCalculatedLevel":
case "client.user.risk.calculated_score":
case "ClientUserRiskCalculatedScore":
case "client.user.risk.calculated_score_norm":
case "ClientUserRiskCalculatedScoreNorm":
case "client.user.risk.static_level":
case "ClientUserRiskStaticLevel":
case "client.user.risk.static_score":
case "ClientUserRiskStaticScore":
case "client.user.risk.static_score_norm":
case "ClientUserRiskStaticScoreNorm":
return TrySetClient(document, path, value);
case "cloud.account.id":
case "CloudAccountId":
case "cloud.account.name":
case "CloudAccountName":
case "cloud.availability_zone":
case "CloudAvailabilityZone":
case "cloud.instance.id":
case "CloudInstanceId":
case "cloud.instance.name":
case "CloudInstanceName":
case "cloud.machine.type":
case "CloudMachineType":
case "cloud.project.id":
case "CloudProjectId":
case "cloud.project.name":
case "CloudProjectName":
case "cloud.provider":
case "CloudProvider":
case "cloud.region":
case "CloudRegion":
case "cloud.service.name":
case "CloudServiceName":
return TrySetCloud(document, path, value);
case "code_signature.digest_algorithm":
case "CodeSignatureDigestAlgorithm":
case "code_signature.exists":
case "CodeSignatureExists":
case "code_signature.signing_id":
case "CodeSignatureSigningId":
case "code_signature.status":
case "CodeSignatureStatus":
case "code_signature.subject_name":
case "CodeSignatureSubjectName":
case "code_signature.team_id":
case "CodeSignatureTeamId":
case "code_signature.timestamp":
case "CodeSignatureTimestamp":
case "code_signature.trusted":
case "CodeSignatureTrusted":
case "code_signature.valid":
case "CodeSignatureValid":
return TrySetCodeSignature(document, path, value);
case "container.cpu.usage":
case "ContainerCpuUsage":
case "container.disk.read.bytes":
case "ContainerDiskReadBytes":
case "container.disk.write.bytes":
case "ContainerDiskWriteBytes":
case "container.id":
case "ContainerId":
case "container.image.name":
case "ContainerImageName":
case "container.memory.usage":
case "ContainerMemoryUsage":
case "container.name":
case "ContainerName":
case "container.network.egress.bytes":
case "ContainerNetworkEgressBytes":
case "container.network.ingress.bytes":
case "ContainerNetworkIngressBytes":
case "container.runtime":
case "ContainerRuntime":
case "container.security_context.privileged":
case "ContainerSecurityContextPrivileged":
return TrySetContainer(document, path, value);
case "data_stream.dataset":
case "DataStreamDataset":
case "data_stream.namespace":
case "DataStreamNamespace":
case "data_stream.type":
case "DataStreamType":
return TrySetDataStream(document, path, value);
case "destination.address":
case "DestinationAddress":
case "destination.bytes":
case "DestinationBytes":
case "destination.domain":
case "DestinationDomain":
case "destination.ip":
case "DestinationIp":
case "destination.mac":
case "DestinationMac":
case "destination.nat.ip":
case "DestinationNatIp":
case "destination.nat.port":
case "DestinationNatPort":
case "destination.packets":
case "DestinationPackets":
case "destination.port":
case "DestinationPort":
case "destination.registered_domain":
case "DestinationRegisteredDomain":
case "destination.subdomain":
case "DestinationSubdomain":
case "destination.top_level_domain":
case "DestinationTopLevelDomain":
case "destination.as.number":
case "DestinationAsNumber":
case "destination.as.organization.name":
case "DestinationAsOrganizationName":
case "destination.geo.city_name":
case "DestinationGeoCityName":
case "destination.geo.continent_code":
case "DestinationGeoContinentCode":
case "destination.geo.continent_name":
case "DestinationGeoContinentName":
case "destination.geo.country_iso_code":
case "DestinationGeoCountryIsoCode":
case "destination.geo.country_name":
case "DestinationGeoCountryName":
case "destination.geo.location":
case "DestinationGeoLocation":
case "destination.geo.name":
case "DestinationGeoName":
case "destination.geo.postal_code":
case "DestinationGeoPostalCode":
case "destination.geo.region_iso_code":
case "DestinationGeoRegionIsoCode":
case "destination.geo.region_name":
case "DestinationGeoRegionName":
case "destination.geo.timezone":
case "DestinationGeoTimezone":
case "destination.user.domain":
case "DestinationUserDomain":
case "destination.user.email":
case "DestinationUserEmail":
case "destination.user.full_name":
case "DestinationUserFullName":
case "destination.user.hash":
case "DestinationUserHash":
case "destination.user.id":
case "DestinationUserId":
case "destination.user.name":
case "DestinationUserName":
case "destination.user.group.domain":
case "DestinationUserGroupDomain":
case "destination.user.group.id":
case "DestinationUserGroupId":
case "destination.user.group.name":
case "DestinationUserGroupName":
case "destination.user.risk.calculated_level":
case "DestinationUserRiskCalculatedLevel":
case "destination.user.risk.calculated_score":
case "DestinationUserRiskCalculatedScore":
case "destination.user.risk.calculated_score_norm":
case "DestinationUserRiskCalculatedScoreNorm":
case "destination.user.risk.static_level":
case "DestinationUserRiskStaticLevel":
case "destination.user.risk.static_score":
case "DestinationUserRiskStaticScore":
case "destination.user.risk.static_score_norm":
case "DestinationUserRiskStaticScoreNorm":
return TrySetDestination(document, path, value);
case "device.id":
case "DeviceId":
case "device.manufacturer":
case "DeviceManufacturer":
case "device.model.identifier":
case "DeviceModelIdentifier":
case "device.model.name":
case "DeviceModelName":
return TrySetDevice(document, path, value);
case "dll.name":
case "DllName":
case "dll.path":
case "DllPath":
case "dll.hash.md5":
case "DllHashMd5":
case "dll.hash.sha1":
case "DllHashSha1":
case "dll.hash.sha256":
case "DllHashSha256":
case "dll.hash.sha384":
case "DllHashSha384":
case "dll.hash.sha512":
case "DllHashSha512":
case "dll.hash.ssdeep":
case "DllHashSsdeep":
case "dll.hash.tlsh":
case "DllHashTlsh":
case "dll.pe.architecture":
case "DllPeArchitecture":
case "dll.pe.company":
case "DllPeCompany":
case "dll.pe.description":
case "DllPeDescription":
case "dll.pe.file_version":
case "DllPeFileVersion":
case "dll.pe.go_import_hash":
case "DllPeGoImportHash":
case "dll.pe.go_imports":
case "DllPeGoImports":
case "dll.pe.go_imports_names_entropy":
case "DllPeGoImportsNamesEntropy":
case "dll.pe.go_imports_names_var_entropy":
case "DllPeGoImportsNamesVarEntropy":
case "dll.pe.go_stripped":
case "DllPeGoStripped":
case "dll.pe.imphash":
case "DllPeImphash":
case "dll.pe.import_hash":
case "DllPeImportHash":
case "dll.pe.imports_names_entropy":
case "DllPeImportsNamesEntropy":
case "dll.pe.imports_names_var_entropy":
case "DllPeImportsNamesVarEntropy":
case "dll.pe.original_file_name":
case "DllPeOriginalFileName":
case "dll.pe.pehash":
case "DllPePehash":
case "dll.pe.product":
case "DllPeProduct":
case "dll.code_signature.digest_algorithm":
case "DllCodeSignatureDigestAlgorithm":
case "dll.code_signature.exists":
case "DllCodeSignatureExists":
case "dll.code_signature.signing_id":
case "DllCodeSignatureSigningId":
case "dll.code_signature.status":
case "DllCodeSignatureStatus":
case "dll.code_signature.subject_name":
case "DllCodeSignatureSubjectName":
case "dll.code_signature.team_id":
case "DllCodeSignatureTeamId":
case "dll.code_signature.timestamp":
case "DllCodeSignatureTimestamp":
case "dll.code_signature.trusted":
case "DllCodeSignatureTrusted":
case "dll.code_signature.valid":
case "DllCodeSignatureValid":
return TrySetDll(document, path, value);
case "dns.id":
case "DnsId":
case "dns.op_code":
case "DnsOpCode":
case "dns.question.class":
case "DnsQuestionClass":
case "dns.question.name":
case "DnsQuestionName":
case "dns.question.registered_domain":
case "DnsQuestionRegisteredDomain":
case "dns.question.subdomain":
case "DnsQuestionSubdomain":
case "dns.question.top_level_domain":
case "DnsQuestionTopLevelDomain":
case "dns.question.type":
case "DnsQuestionType":
case "dns.response_code":
case "DnsResponseCode":
case "dns.type":
case "DnsType":
return TrySetDns(document, path, value);
case "ecs.version":
case "EcsVersion":
return TrySetEcs(document, path, value);
case "elf.architecture":
case "ElfArchitecture":
case "elf.byte_order":
case "ElfByteOrder":
case "elf.cpu_type":
case "ElfCpuType":
case "elf.creation_date":
case "ElfCreationDate":
case "elf.go_import_hash":
case "ElfGoImportHash":
case "elf.go_imports":
case "ElfGoImports":
case "elf.go_imports_names_entropy":
case "ElfGoImportsNamesEntropy":
case "elf.go_imports_names_var_entropy":
case "ElfGoImportsNamesVarEntropy":
case "elf.go_stripped":
case "ElfGoStripped":
case "elf.header.abi_version":
case "ElfHeaderAbiVersion":
case "elf.header.class":
case "ElfHeaderClass":
case "elf.header.data":
case "ElfHeaderData":
case "elf.header.entrypoint":
case "ElfHeaderEntrypoint":
case "elf.header.object_version":
case "ElfHeaderObjectVersion":
case "elf.header.os_abi":
case "ElfHeaderOsAbi":
case "elf.header.type":
case "ElfHeaderType":
case "elf.header.version":
case "ElfHeaderVersion":
case "elf.import_hash":
case "ElfImportHash":
case "elf.imports_names_entropy":
case "ElfImportsNamesEntropy":
case "elf.imports_names_var_entropy":
case "ElfImportsNamesVarEntropy":
case "elf.telfhash":
case "ElfTelfhash":
return TrySetElf(document, path, value);
case "email.content_type":
case "EmailContentType":
case "email.delivery_timestamp":
case "EmailDeliveryTimestamp":
case "email.direction":
case "EmailDirection":
case "email.local_id":
case "EmailLocalId":
case "email.message_id":
case "EmailMessageId":
case "email.origination_timestamp":
case "EmailOriginationTimestamp":
case "email.sender.address":
case "EmailSenderAddress":
case "email.subject":
case "EmailSubject":
case "email.x_mailer":
case "EmailXMailer":
return TrySetEmail(document, path, value);
case "error.code":
case "ErrorCode":
case "error.id":
case "ErrorId":
case "error.message":
case "ErrorMessage":
case "error.stack_trace":
case "ErrorStackTrace":
case "error.type":
case "ErrorType":
return TrySetError(document, path, value);
case "event.action":
case "EventAction":
case "event.agent_id_status":
case "EventAgentIdStatus":
case "event.code":
case "EventCode":
case "event.created":
case "EventCreated":
case "event.dataset":
case "EventDataset":
case "event.duration":
case "EventDuration":
case "event.end":
case "EventEnd":
case "event.hash":
case "EventHash":
case "event.id":
case "EventId":
case "event.ingested":
case "EventIngested":
case "event.kind":
case "EventKind":
case "event.module":
case "EventModule":
case "event.original":
case "EventOriginal":
case "event.outcome":
case "EventOutcome":
case "event.provider":
case "EventProvider":
case "event.reason":
case "EventReason":
case "event.reference":
case "EventReference":
case "event.risk_score":
case "EventRiskScore":
case "event.risk_score_norm":
case "EventRiskScoreNorm":
case "event.sequence":
case "EventSequence":
case "event.severity":
case "EventSeverity":
case "event.start":
case "EventStart":
case "event.timezone":
case "EventTimezone":
case "event.url":
case "EventUrl":
return TrySetEvent(document, path, value);
case "faas.coldstart":
case "FaasColdstart":
case "faas.execution":
case "FaasExecution":
case "faas.id":
case "FaasId":
case "faas.name":
case "FaasName":
case "faas.trigger.request_id":
case "FaasTriggerRequestId":
case "faas.trigger.type":
case "FaasTriggerType":
case "faas.version":
case "FaasVersion":
return TrySetFaas(document, path, value);
case "file.accessed":
case "FileAccessed":
case "file.created":
case "FileCreated":
case "file.ctime":
case "FileCtime":
case "file.device":
case "FileDevice":
case "file.directory":
case "FileDirectory":
case "file.drive_letter":
case "FileDriveLetter":
case "file.extension":
case "FileExtension":
case "file.fork_name":
case "FileForkName":
case "file.gid":
case "FileGid":
case "file.group":
case "FileGroup":
case "file.inode":
case "FileInode":
case "file.mime_type":
case "FileMimeType":
case "file.mode":
case "FileMode":
case "file.mtime":
case "FileMtime":
case "file.name":
case "FileName":
case "file.owner":
case "FileOwner":
case "file.path":
case "FilePath":
case "file.size":
case "FileSize":
case "file.target_path":
case "FileTargetPath":
case "file.type":
case "FileType":
case "file.uid":
case "FileUid":
case "file.hash.md5":
case "FileHashMd5":
case "file.hash.sha1":
case "FileHashSha1":
case "file.hash.sha256":
case "FileHashSha256":
case "file.hash.sha384":
case "FileHashSha384":
case "file.hash.sha512":
case "FileHashSha512":
case "file.hash.ssdeep":
case "FileHashSsdeep":
case "file.hash.tlsh":
case "FileHashTlsh":
case "file.pe.architecture":
case "FilePeArchitecture":
case "file.pe.company":
case "FilePeCompany":
case "file.pe.description":
case "FilePeDescription":
case "file.pe.file_version":
case "FilePeFileVersion":
case "file.pe.go_import_hash":
case "FilePeGoImportHash":
case "file.pe.go_imports":
case "FilePeGoImports":
case "file.pe.go_imports_names_entropy":
case "FilePeGoImportsNamesEntropy":
case "file.pe.go_imports_names_var_entropy":
case "FilePeGoImportsNamesVarEntropy":
case "file.pe.go_stripped":
case "FilePeGoStripped":
case "file.pe.imphash":
case "FilePeImphash":
case "file.pe.import_hash":
case "FilePeImportHash":
case "file.pe.imports_names_entropy":
case "FilePeImportsNamesEntropy":
case "file.pe.imports_names_var_entropy":
case "FilePeImportsNamesVarEntropy":
case "file.pe.original_file_name":
case "FilePeOriginalFileName":
case "file.pe.pehash":
case "FilePePehash":
case "file.pe.product":
case "FilePeProduct":
case "file.x509.issuer.distinguished_name":
case "FileX509IssuerDistinguishedName":
case "file.x509.not_after":
case "FileX509NotAfter":
case "file.x509.not_before":
case "FileX509NotBefore":
case "file.x509.public_key_algorithm":
case "FileX509PublicKeyAlgorithm":
case "file.x509.public_key_curve":
case "FileX509PublicKeyCurve":
case "file.x509.public_key_exponent":
case "FileX509PublicKeyExponent":
case "file.x509.public_key_size":
case "FileX509PublicKeySize":
case "file.x509.serial_number":
case "FileX509SerialNumber":
case "file.x509.signature_algorithm":
case "FileX509SignatureAlgorithm":
case "file.x509.subject.distinguished_name":
case "FileX509SubjectDistinguishedName":
case "file.x509.version_number":
case "FileX509VersionNumber":
case "file.code_signature.digest_algorithm":
case "FileCodeSignatureDigestAlgorithm":
case "file.code_signature.exists":
case "FileCodeSignatureExists":
case "file.code_signature.signing_id":
case "FileCodeSignatureSigningId":
case "file.code_signature.status":
case "FileCodeSignatureStatus":
case "file.code_signature.subject_name":
case "FileCodeSignatureSubjectName":
case "file.code_signature.team_id":
case "FileCodeSignatureTeamId":
case "file.code_signature.timestamp":
case "FileCodeSignatureTimestamp":
case "file.code_signature.trusted":
case "FileCodeSignatureTrusted":
case "file.code_signature.valid":
case "FileCodeSignatureValid":
case "file.elf.architecture":
case "FileElfArchitecture":
case "file.elf.byte_order":
case "FileElfByteOrder":
case "file.elf.cpu_type":
case "FileElfCpuType":
case "file.elf.creation_date":
case "FileElfCreationDate":
case "file.elf.go_import_hash":
case "FileElfGoImportHash":
case "file.elf.go_imports":
case "FileElfGoImports":
case "file.elf.go_imports_names_entropy":
case "FileElfGoImportsNamesEntropy":
case "file.elf.go_imports_names_var_entropy":
case "FileElfGoImportsNamesVarEntropy":
case "file.elf.go_stripped":
case "FileElfGoStripped":
case "file.elf.header.abi_version":
case "FileElfHeaderAbiVersion":
case "file.elf.header.class":
case "FileElfHeaderClass":
case "file.elf.header.data":
case "FileElfHeaderData":
case "file.elf.header.entrypoint":
case "FileElfHeaderEntrypoint":
case "file.elf.header.object_version":
case "FileElfHeaderObjectVersion":
case "file.elf.header.os_abi":
case "FileElfHeaderOsAbi":
case "file.elf.header.type":
case "FileElfHeaderType":
case "file.elf.header.version":
case "FileElfHeaderVersion":
case "file.elf.import_hash":
case "FileElfImportHash":
case "file.elf.imports_names_entropy":
case "FileElfImportsNamesEntropy":
case "file.elf.imports_names_var_entropy":
case "FileElfImportsNamesVarEntropy":
case "file.elf.telfhash":
case "FileElfTelfhash":
case "file.macho.go_import_hash":
case "FileMachoGoImportHash":
case "file.macho.go_imports":
case "FileMachoGoImports":
case "file.macho.go_imports_names_entropy":
case "FileMachoGoImportsNamesEntropy":
case "file.macho.go_imports_names_var_entropy":
case "FileMachoGoImportsNamesVarEntropy":
case "file.macho.go_stripped":
case "FileMachoGoStripped":
case "file.macho.import_hash":
case "FileMachoImportHash":
case "file.macho.imports_names_entropy":
case "FileMachoImportsNamesEntropy":
case "file.macho.imports_names_var_entropy":
case "FileMachoImportsNamesVarEntropy":
case "file.macho.symhash":
case "FileMachoSymhash":
return TrySetFile(document, path, value);
case "geo.city_name":
case "GeoCityName":
case "geo.continent_code":
case "GeoContinentCode":
case "geo.continent_name":
case "GeoContinentName":
case "geo.country_iso_code":
case "GeoCountryIsoCode":
case "geo.country_name":
case "GeoCountryName":
case "geo.location":
case "GeoLocation":
case "geo.name":
case "GeoName":
case "geo.postal_code":
case "GeoPostalCode":
case "geo.region_iso_code":
case "GeoRegionIsoCode":
case "geo.region_name":
case "GeoRegionName":
case "geo.timezone":
case "GeoTimezone":
return TrySetGeo(document, path, value);
case "group.domain":
case "GroupDomain":
case "group.id":
case "GroupId":
case "group.name":
case "GroupName":
return TrySetGroup(document, path, value);
case "hash.md5":
case "HashMd5":
case "hash.sha1":
case "HashSha1":
case "hash.sha256":
case "HashSha256":
case "hash.sha384":
case "HashSha384":
case "hash.sha512":
case "HashSha512":
case "hash.ssdeep":
case "HashSsdeep":
case "hash.tlsh":
case "HashTlsh":
return TrySetHash(document, path, value);
case "host.architecture":
case "HostArchitecture":
case "host.boot.id":
case "HostBootId":
case "host.cpu.usage":
case "HostCpuUsage":
case "host.disk.read.bytes":
case "HostDiskReadBytes":
case "host.disk.write.bytes":
case "HostDiskWriteBytes":
case "host.domain":
case "HostDomain":
case "host.hostname":
case "HostHostname":
case "host.id":
case "HostId":
case "host.name":
case "HostName":
case "host.network.egress.bytes":
case "HostNetworkEgressBytes":
case "host.network.egress.packets":
case "HostNetworkEgressPackets":
case "host.network.ingress.bytes":
case "HostNetworkIngressBytes":
case "host.network.ingress.packets":
case "HostNetworkIngressPackets":
case "host.pid_ns_ino":
case "HostPidNsIno":
case "host.type":
case "HostType":
case "host.uptime":
case "HostUptime":
case "host.geo.city_name":
case "HostGeoCityName":
case "host.geo.continent_code":
case "HostGeoContinentCode":
case "host.geo.continent_name":
case "HostGeoContinentName":
case "host.geo.country_iso_code":
case "HostGeoCountryIsoCode":
case "host.geo.country_name":
case "HostGeoCountryName":
case "host.geo.location":
case "HostGeoLocation":
case "host.geo.name":
case "HostGeoName":
case "host.geo.postal_code":
case "HostGeoPostalCode":
case "host.geo.region_iso_code":
case "HostGeoRegionIsoCode":
case "host.geo.region_name":
case "HostGeoRegionName":
case "host.geo.timezone":
case "HostGeoTimezone":
case "host.os.family":
case "HostOsFamily":
case "host.os.full":
case "HostOsFull":
case "host.os.kernel":
case "HostOsKernel":
case "host.os.name":
case "HostOsName":
case "host.os.platform":
case "HostOsPlatform":
case "host.os.type":
case "HostOsType":
case "host.os.version":
case "HostOsVersion":
case "host.risk.calculated_level":
case "HostRiskCalculatedLevel":
case "host.risk.calculated_score":
case "HostRiskCalculatedScore":
case "host.risk.calculated_score_norm":
case "HostRiskCalculatedScoreNorm":
case "host.risk.static_level":
case "HostRiskStaticLevel":
case "host.risk.static_score":
case "HostRiskStaticScore":
case "host.risk.static_score_norm":
case "HostRiskStaticScoreNorm":
return TrySetHost(document, path, value);
case "http.request.body.bytes":
case "HttpRequestBodyBytes":
case "http.request.body.content":
case "HttpRequestBodyContent":
case "http.request.bytes":
case "HttpRequestBytes":
case "http.request.id":
case "HttpRequestId":
case "http.request.method":
case "HttpRequestMethod":
case "http.request.mime_type":
case "HttpRequestMimeType":
case "http.request.referrer":
case "HttpRequestReferrer":
case "http.response.body.bytes":
case "HttpResponseBodyBytes":
case "http.response.body.content":
case "HttpResponseBodyContent":
case "http.response.bytes":
case "HttpResponseBytes":
case "http.response.mime_type":
case "HttpResponseMimeType":
case "http.response.status_code":
case "HttpResponseStatusCode":
case "http.version":
case "HttpVersion":
return TrySetHttp(document, path, value);
case "interface.alias":
case "InterfaceAlias":
case "interface.id":
case "InterfaceId":
case "interface.name":
case "InterfaceName":
return TrySetInterface(document, path, value);
case "log.file.path":
case "LogFilePath":
case "log.level":
case "LogLevel":
case "log.logger":
case "LogLogger":
case "log.origin.file.line":
case "LogOriginFileLine":
case "log.origin.file.name":
case "LogOriginFileName":
case "log.origin.function":
case "LogOriginFunction":
return TrySetLog(document, path, value);
case "macho.go_import_hash":
case "MachoGoImportHash":
case "macho.go_imports":
case "MachoGoImports":
case "macho.go_imports_names_entropy":
case "MachoGoImportsNamesEntropy":
case "macho.go_imports_names_var_entropy":
case "MachoGoImportsNamesVarEntropy":
case "macho.go_stripped":
case "MachoGoStripped":
case "macho.import_hash":
case "MachoImportHash":
case "macho.imports_names_entropy":
case "MachoImportsNamesEntropy":
case "macho.imports_names_var_entropy":
case "MachoImportsNamesVarEntropy":
case "macho.symhash":
case "MachoSymhash":
return TrySetMacho(document, path, value);
case "network.application":
case "NetworkApplication":
case "network.bytes":
case "NetworkBytes":
case "network.community_id":
case "NetworkCommunityId":
case "network.direction":
case "NetworkDirection":
case "network.forwarded_ip":
case "NetworkForwardedIp":
case "network.iana_number":
case "NetworkIanaNumber":
case "network.name":
case "NetworkName":
case "network.packets":
case "NetworkPackets":
case "network.protocol":
case "NetworkProtocol":
case "network.transport":
case "NetworkTransport":
case "network.type":
case "NetworkType":
case "network.vlan.id":
case "NetworkVlanId":
case "network.vlan.name":
case "NetworkVlanName":
return TrySetNetwork(document, path, value);
case "observer.hostname":
case "ObserverHostname":
case "observer.name":
case "ObserverName":
case "observer.product":
case "ObserverProduct":
case "observer.serial_number":
case "ObserverSerialNumber":
case "observer.type":
case "ObserverType":
case "observer.vendor":
case "ObserverVendor":
case "observer.version":
case "ObserverVersion":
case "observer.geo.city_name":
case "ObserverGeoCityName":
case "observer.geo.continent_code":
case "ObserverGeoContinentCode":
case "observer.geo.continent_name":
case "ObserverGeoContinentName":
case "observer.geo.country_iso_code":
case "ObserverGeoCountryIsoCode":
case "observer.geo.country_name":
case "ObserverGeoCountryName":
case "observer.geo.location":
case "ObserverGeoLocation":
case "observer.geo.name":
case "ObserverGeoName":
case "observer.geo.postal_code":
case "ObserverGeoPostalCode":
case "observer.geo.region_iso_code":
case "ObserverGeoRegionIsoCode":
case "observer.geo.region_name":
case "ObserverGeoRegionName":
case "observer.geo.timezone":
case "ObserverGeoTimezone":
case "observer.os.family":
case "ObserverOsFamily":
case "observer.os.full":
case "ObserverOsFull":
case "observer.os.kernel":
case "ObserverOsKernel":
case "observer.os.name":
case "ObserverOsName":
case "observer.os.platform":
case "ObserverOsPlatform":
case "observer.os.type":
case "ObserverOsType":
case "observer.os.version":
case "ObserverOsVersion":
return TrySetObserver(document, path, value);
case "orchestrator.api_version":
case "OrchestratorApiVersion":
case "orchestrator.cluster.id":
case "OrchestratorClusterId":
case "orchestrator.cluster.name":
case "OrchestratorClusterName":
case "orchestrator.cluster.url":
case "OrchestratorClusterUrl":
case "orchestrator.cluster.version":
case "OrchestratorClusterVersion":
case "orchestrator.namespace":
case "OrchestratorNamespace":
case "orchestrator.organization":
case "OrchestratorOrganization":
case "orchestrator.resource.id":
case "OrchestratorResourceId":
case "orchestrator.resource.name":
case "OrchestratorResourceName":
case "orchestrator.resource.parent.type":
case "OrchestratorResourceParentType":
case "orchestrator.resource.type":
case "OrchestratorResourceType":
case "orchestrator.type":
case "OrchestratorType":
return TrySetOrchestrator(document, path, value);
case "organization.id":
case "OrganizationId":
case "organization.name":
case "OrganizationName":
return TrySetOrganization(document, path, value);
case "os.family":
case "OsFamily":
case "os.full":
case "OsFull":
case "os.kernel":
case "OsKernel":
case "os.name":
case "OsName":
case "os.platform":
case "OsPlatform":
case "os.type":
case "OsType":
case "os.version":
case "OsVersion":
return TrySetOs(document, path, value);
case "package.architecture":
case "PackageArchitecture":
case "package.build_version":
case "PackageBuildVersion":
case "package.checksum":
case "PackageChecksum":
case "package.description":
case "PackageDescription":
case "package.install_scope":
case "PackageInstallScope":
case "package.installed":
case "PackageInstalled":
case "package.license":
case "PackageLicense":
case "package.name":
case "PackageName":
case "package.path":
case "PackagePath":
case "package.reference":
case "PackageReference":
case "package.size":
case "PackageSize":
case "package.type":
case "PackageType":
case "package.version":
case "PackageVersion":
return TrySetPackage(document, path, value);
case "pe.architecture":
case "PeArchitecture":
case "pe.company":
case "PeCompany":
case "pe.description":
case "PeDescription":
case "pe.file_version":
case "PeFileVersion":
case "pe.go_import_hash":
case "PeGoImportHash":
case "pe.go_imports":
case "PeGoImports":
case "pe.go_imports_names_entropy":
case "PeGoImportsNamesEntropy":
case "pe.go_imports_names_var_entropy":
case "PeGoImportsNamesVarEntropy":
case "pe.go_stripped":
case "PeGoStripped":
case "pe.imphash":
case "PeImphash":
case "pe.import_hash":
case "PeImportHash":
case "pe.imports_names_entropy":
case "PeImportsNamesEntropy":
case "pe.imports_names_var_entropy":
case "PeImportsNamesVarEntropy":
case "pe.original_file_name":
case "PeOriginalFileName":
case "pe.pehash":
case "PePehash":
case "pe.product":
case "PeProduct":
return TrySetPe(document, path, value);
case "process.args_count":
case "ProcessArgsCount":
case "process.command_line":
case "ProcessCommandLine":
case "process.end":
case "ProcessEnd":
case "process.entity_id":
case "ProcessEntityId":
case "process.executable":
case "ProcessExecutable":
case "process.exit_code":
case "ProcessExitCode":
case "process.interactive":
case "ProcessInteractive":
case "process.name":
case "ProcessName":
case "process.pgid":
case "ProcessPgid":
case "process.pid":
case "ProcessPid":
case "process.start":
case "ProcessStart":
case "process.thread.id":
case "ProcessThreadId":
case "process.thread.name":
case "ProcessThreadName":
case "process.title":
case "ProcessTitle":
case "process.uptime":
case "ProcessUptime":
case "process.vpid":
case "ProcessVpid":
case "process.working_directory":
case "ProcessWorkingDirectory":
case "process.group.domain":
case "ProcessGroupDomain":
case "process.group.id":
case "ProcessGroupId":
case "process.group.name":
case "ProcessGroupName":
case "process.real_group.domain":
case "ProcessRealGroupDomain":
case "process.real_group.id":
case "ProcessRealGroupId":
case "process.real_group.name":
case "ProcessRealGroupName":
case "process.saved_group.domain":
case "ProcessSavedGroupDomain":
case "process.saved_group.id":
case "ProcessSavedGroupId":
case "process.saved_group.name":
case "ProcessSavedGroupName":
case "process.hash.md5":
case "ProcessHashMd5":
case "process.hash.sha1":
case "ProcessHashSha1":
case "process.hash.sha256":
case "ProcessHashSha256":
case "process.hash.sha384":
case "ProcessHashSha384":
case "process.hash.sha512":
case "ProcessHashSha512":
case "process.hash.ssdeep":
case "ProcessHashSsdeep":
case "process.hash.tlsh":
case "ProcessHashTlsh":
case "process.pe.architecture":
case "ProcessPeArchitecture":
case "process.pe.company":
case "ProcessPeCompany":
case "process.pe.description":
case "ProcessPeDescription":
case "process.pe.file_version":
case "ProcessPeFileVersion":
case "process.pe.go_import_hash":
case "ProcessPeGoImportHash":
case "process.pe.go_imports":
case "ProcessPeGoImports":
case "process.pe.go_imports_names_entropy":
case "ProcessPeGoImportsNamesEntropy":
case "process.pe.go_imports_names_var_entropy":
case "ProcessPeGoImportsNamesVarEntropy":
case "process.pe.go_stripped":
case "ProcessPeGoStripped":
case "process.pe.imphash":
case "ProcessPeImphash":
case "process.pe.import_hash":
case "ProcessPeImportHash":
case "process.pe.imports_names_entropy":
case "ProcessPeImportsNamesEntropy":
case "process.pe.imports_names_var_entropy":
case "ProcessPeImportsNamesVarEntropy":
case "process.pe.original_file_name":
case "ProcessPeOriginalFileName":
case "process.pe.pehash":
case "ProcessPePehash":
case "process.pe.product":
case "ProcessPeProduct":
case "process.code_signature.digest_algorithm":
case "ProcessCodeSignatureDigestAlgorithm":
case "process.code_signature.exists":
case "ProcessCodeSignatureExists":
case "process.code_signature.signing_id":
case "ProcessCodeSignatureSigningId":
case "process.code_signature.status":
case "ProcessCodeSignatureStatus":
case "process.code_signature.subject_name":
case "ProcessCodeSignatureSubjectName":
case "process.code_signature.team_id":
case "ProcessCodeSignatureTeamId":
case "process.code_signature.timestamp":
case "ProcessCodeSignatureTimestamp":
case "process.code_signature.trusted":
case "ProcessCodeSignatureTrusted":
case "process.code_signature.valid":
case "ProcessCodeSignatureValid":
case "process.elf.architecture":
case "ProcessElfArchitecture":
case "process.elf.byte_order":
case "ProcessElfByteOrder":
case "process.elf.cpu_type":
case "ProcessElfCpuType":
case "process.elf.creation_date":
case "ProcessElfCreationDate":
case "process.elf.go_import_hash":
case "ProcessElfGoImportHash":
case "process.elf.go_imports":
case "ProcessElfGoImports":
case "process.elf.go_imports_names_entropy":
case "ProcessElfGoImportsNamesEntropy":
case "process.elf.go_imports_names_var_entropy":
case "ProcessElfGoImportsNamesVarEntropy":
case "process.elf.go_stripped":
case "ProcessElfGoStripped":
case "process.elf.header.abi_version":
case "ProcessElfHeaderAbiVersion":
case "process.elf.header.class":
case "ProcessElfHeaderClass":
case "process.elf.header.data":
case "ProcessElfHeaderData":
case "process.elf.header.entrypoint":
case "ProcessElfHeaderEntrypoint":
case "process.elf.header.object_version":
case "ProcessElfHeaderObjectVersion":
case "process.elf.header.os_abi":
case "ProcessElfHeaderOsAbi":
case "process.elf.header.type":
case "ProcessElfHeaderType":
case "process.elf.header.version":
case "ProcessElfHeaderVersion":
case "process.elf.import_hash":
case "ProcessElfImportHash":
case "process.elf.imports_names_entropy":
case "ProcessElfImportsNamesEntropy":
case "process.elf.imports_names_var_entropy":
case "ProcessElfImportsNamesVarEntropy":
case "process.elf.telfhash":
case "ProcessElfTelfhash":
case "process.macho.go_import_hash":
case "ProcessMachoGoImportHash":
case "process.macho.go_imports":
case "ProcessMachoGoImports":
case "process.macho.go_imports_names_entropy":
case "ProcessMachoGoImportsNamesEntropy":
case "process.macho.go_imports_names_var_entropy":
case "ProcessMachoGoImportsNamesVarEntropy":
case "process.macho.go_stripped":
case "ProcessMachoGoStripped":
case "process.macho.import_hash":
case "ProcessMachoImportHash":
case "process.macho.imports_names_entropy":
case "ProcessMachoImportsNamesEntropy":
case "process.macho.imports_names_var_entropy":
case "ProcessMachoImportsNamesVarEntropy":
case "process.macho.symhash":
case "ProcessMachoSymhash":
case "process.entry_meta.source.address":
case "ProcessEntryMetaSourceAddress":
case "process.entry_meta.source.bytes":
case "ProcessEntryMetaSourceBytes":
case "process.entry_meta.source.domain":
case "ProcessEntryMetaSourceDomain":
case "process.entry_meta.source.ip":
case "ProcessEntryMetaSourceIp":
case "process.entry_meta.source.mac":
case "ProcessEntryMetaSourceMac":
case "process.entry_meta.source.nat.ip":
case "ProcessEntryMetaSourceNatIp":
case "process.entry_meta.source.nat.port":
case "ProcessEntryMetaSourceNatPort":
case "process.entry_meta.source.packets":
case "ProcessEntryMetaSourcePackets":
case "process.entry_meta.source.port":
case "ProcessEntryMetaSourcePort":
case "process.entry_meta.source.registered_domain":
case "ProcessEntryMetaSourceRegisteredDomain":
case "process.entry_meta.source.subdomain":
case "ProcessEntryMetaSourceSubdomain":
case "process.entry_meta.source.top_level_domain":
case "ProcessEntryMetaSourceTopLevelDomain":
case "process.entry_meta.source.as.number":
case "ProcessEntryMetaSourceAsNumber":
case "process.entry_meta.source.as.organization.name":
case "ProcessEntryMetaSourceAsOrganizationName":
case "process.entry_meta.source.geo.city_name":
case "ProcessEntryMetaSourceGeoCityName":
case "process.entry_meta.source.geo.continent_code":
case "ProcessEntryMetaSourceGeoContinentCode":
case "process.entry_meta.source.geo.continent_name":
case "ProcessEntryMetaSourceGeoContinentName":
case "process.entry_meta.source.geo.country_iso_code":
case "ProcessEntryMetaSourceGeoCountryIsoCode":
case "process.entry_meta.source.geo.country_name":
case "ProcessEntryMetaSourceGeoCountryName":
case "process.entry_meta.source.geo.location":
case "ProcessEntryMetaSourceGeoLocation":
case "process.entry_meta.source.geo.name":
case "ProcessEntryMetaSourceGeoName":
case "process.entry_meta.source.geo.postal_code":
case "ProcessEntryMetaSourceGeoPostalCode":
case "process.entry_meta.source.geo.region_iso_code":
case "ProcessEntryMetaSourceGeoRegionIsoCode":
case "process.entry_meta.source.geo.region_name":
case "ProcessEntryMetaSourceGeoRegionName":
case "process.entry_meta.source.geo.timezone":
case "ProcessEntryMetaSourceGeoTimezone":
case "process.entry_meta.source.user.domain":
case "ProcessEntryMetaSourceUserDomain":
case "process.entry_meta.source.user.email":
case "ProcessEntryMetaSourceUserEmail":
case "process.entry_meta.source.user.full_name":
case "ProcessEntryMetaSourceUserFullName":
case "process.entry_meta.source.user.hash":
case "ProcessEntryMetaSourceUserHash":
case "process.entry_meta.source.user.id":
case "ProcessEntryMetaSourceUserId":
case "process.entry_meta.source.user.name":
case "ProcessEntryMetaSourceUserName":
case "process.entry_meta.source.user.group.domain":
case "ProcessEntryMetaSourceUserGroupDomain":
case "process.entry_meta.source.user.group.id":
case "ProcessEntryMetaSourceUserGroupId":
case "process.entry_meta.source.user.group.name":
case "ProcessEntryMetaSourceUserGroupName":
case "process.entry_meta.source.user.risk.calculated_level":
case "ProcessEntryMetaSourceUserRiskCalculatedLevel":
case "process.entry_meta.source.user.risk.calculated_score":
case "ProcessEntryMetaSourceUserRiskCalculatedScore":
case "process.entry_meta.source.user.risk.calculated_score_norm":
case "ProcessEntryMetaSourceUserRiskCalculatedScoreNorm":
case "process.entry_meta.source.user.risk.static_level":
case "ProcessEntryMetaSourceUserRiskStaticLevel":
case "process.entry_meta.source.user.risk.static_score":
case "ProcessEntryMetaSourceUserRiskStaticScore":
case "process.entry_meta.source.user.risk.static_score_norm":
case "ProcessEntryMetaSourceUserRiskStaticScoreNorm":
case "process.user.domain":
case "ProcessUserDomain":
case "process.user.email":
case "ProcessUserEmail":
case "process.user.full_name":
case "ProcessUserFullName":
case "process.user.hash":
case "ProcessUserHash":
case "process.user.id":
case "ProcessUserId":
case "process.user.name":
case "ProcessUserName":
case "process.user.group.domain":
case "ProcessUserGroupDomain":
case "process.user.group.id":
case "ProcessUserGroupId":
case "process.user.group.name":
case "ProcessUserGroupName":
case "process.user.risk.calculated_level":
case "ProcessUserRiskCalculatedLevel":
case "process.user.risk.calculated_score":
case "ProcessUserRiskCalculatedScore":
case "process.user.risk.calculated_score_norm":
case "ProcessUserRiskCalculatedScoreNorm":
case "process.user.risk.static_level":
case "ProcessUserRiskStaticLevel":
case "process.user.risk.static_score":
case "ProcessUserRiskStaticScore":
case "process.user.risk.static_score_norm":
case "ProcessUserRiskStaticScoreNorm":
case "process.saved_user.domain":
case "ProcessSavedUserDomain":
case "process.saved_user.email":
case "ProcessSavedUserEmail":
case "process.saved_user.full_name":
case "ProcessSavedUserFullName":
case "process.saved_user.hash":
case "ProcessSavedUserHash":
case "process.saved_user.id":
case "ProcessSavedUserId":
case "process.saved_user.name":
case "ProcessSavedUserName":
case "process.saved_user.group.domain":
case "ProcessSavedUserGroupDomain":
case "process.saved_user.group.id":
case "ProcessSavedUserGroupId":
case "process.saved_user.group.name":
case "ProcessSavedUserGroupName":
case "process.saved_user.risk.calculated_level":
case "ProcessSavedUserRiskCalculatedLevel":
case "process.saved_user.risk.calculated_score":
case "ProcessSavedUserRiskCalculatedScore":
case "process.saved_user.risk.calculated_score_norm":
case "ProcessSavedUserRiskCalculatedScoreNorm":
case "process.saved_user.risk.static_level":
case "ProcessSavedUserRiskStaticLevel":
case "process.saved_user.risk.static_score":
case "ProcessSavedUserRiskStaticScore":
case "process.saved_user.risk.static_score_norm":
case "ProcessSavedUserRiskStaticScoreNorm":
case "process.real_user.domain":
case "ProcessRealUserDomain":
case "process.real_user.email":
case "ProcessRealUserEmail":
case "process.real_user.full_name":
case "ProcessRealUserFullName":
case "process.real_user.hash":
case "ProcessRealUserHash":
case "process.real_user.id":
case "ProcessRealUserId":
case "process.real_user.name":
case "ProcessRealUserName":
case "process.real_user.group.domain":
case "ProcessRealUserGroupDomain":
case "process.real_user.group.id":
case "ProcessRealUserGroupId":
case "process.real_user.group.name":
case "ProcessRealUserGroupName":
case "process.real_user.risk.calculated_level":
case "ProcessRealUserRiskCalculatedLevel":
case "process.real_user.risk.calculated_score":
case "ProcessRealUserRiskCalculatedScore":
case "process.real_user.risk.calculated_score_norm":
case "ProcessRealUserRiskCalculatedScoreNorm":
case "process.real_user.risk.static_level":
case "ProcessRealUserRiskStaticLevel":
case "process.real_user.risk.static_score":
case "ProcessRealUserRiskStaticScore":
case "process.real_user.risk.static_score_norm":
case "ProcessRealUserRiskStaticScoreNorm":
case "process.attested_user.domain":
case "ProcessAttestedUserDomain":
case "process.attested_user.email":
case "ProcessAttestedUserEmail":
case "process.attested_user.full_name":
case "ProcessAttestedUserFullName":
case "process.attested_user.hash":
case "ProcessAttestedUserHash":
case "process.attested_user.id":
case "ProcessAttestedUserId":
case "process.attested_user.name":
case "ProcessAttestedUserName":
case "process.attested_user.group.domain":
case "ProcessAttestedUserGroupDomain":
case "process.attested_user.group.id":
case "ProcessAttestedUserGroupId":
case "process.attested_user.group.name":
case "ProcessAttestedUserGroupName":
case "process.attested_user.risk.calculated_level":
case "ProcessAttestedUserRiskCalculatedLevel":
case "process.attested_user.risk.calculated_score":
case "ProcessAttestedUserRiskCalculatedScore":
case "process.attested_user.risk.calculated_score_norm":
case "ProcessAttestedUserRiskCalculatedScoreNorm":
case "process.attested_user.risk.static_level":
case "ProcessAttestedUserRiskStaticLevel":
case "process.attested_user.risk.static_score":
case "ProcessAttestedUserRiskStaticScore":
case "process.attested_user.risk.static_score_norm":
case "ProcessAttestedUserRiskStaticScoreNorm":
return TrySetProcess(document, path, value);
case "registry.data.bytes":
case "RegistryDataBytes":
case "registry.data.type":
case "RegistryDataType":
case "registry.hive":
case "RegistryHive":
case "registry.key":
case "RegistryKey":
case "registry.path":
case "RegistryPath":
case "registry.value":
case "RegistryValue":
return TrySetRegistry(document, path, value);
case "risk.calculated_level":
case "RiskCalculatedLevel":
case "risk.calculated_score":
case "RiskCalculatedScore":
case "risk.calculated_score_norm":
case "RiskCalculatedScoreNorm":
case "risk.static_level":
case "RiskStaticLevel":
case "risk.static_score":
case "RiskStaticScore":
case "risk.static_score_norm":
case "RiskStaticScoreNorm":
return TrySetRisk(document, path, value);
case "rule.category":
case "RuleCategory":
case "rule.description":
case "RuleDescription":
case "rule.id":
case "RuleId":
case "rule.license":
case "RuleLicense":
case "rule.name":
case "RuleName":
case "rule.reference":
case "RuleReference":
case "rule.ruleset":
case "RuleRuleset":
case "rule.uuid":
case "RuleUuid":
case "rule.version":
case "RuleVersion":
return TrySetRule(document, path, value);
case "server.address":
case "ServerAddress":
case "server.bytes":
case "ServerBytes":
case "server.domain":
case "ServerDomain":
case "server.ip":
case "ServerIp":
case "server.mac":
case "ServerMac":
case "server.nat.ip":
case "ServerNatIp":
case "server.nat.port":
case "ServerNatPort":
case "server.packets":
case "ServerPackets":
case "server.port":
case "ServerPort":
case "server.registered_domain":
case "ServerRegisteredDomain":
case "server.subdomain":
case "ServerSubdomain":
case "server.top_level_domain":
case "ServerTopLevelDomain":
case "server.as.number":
case "ServerAsNumber":
case "server.as.organization.name":
case "ServerAsOrganizationName":
case "server.geo.city_name":
case "ServerGeoCityName":
case "server.geo.continent_code":
case "ServerGeoContinentCode":
case "server.geo.continent_name":
case "ServerGeoContinentName":
case "server.geo.country_iso_code":
case "ServerGeoCountryIsoCode":
case "server.geo.country_name":
case "ServerGeoCountryName":
case "server.geo.location":
case "ServerGeoLocation":
case "server.geo.name":
case "ServerGeoName":
case "server.geo.postal_code":
case "ServerGeoPostalCode":
case "server.geo.region_iso_code":
case "ServerGeoRegionIsoCode":
case "server.geo.region_name":
case "ServerGeoRegionName":
case "server.geo.timezone":
case "ServerGeoTimezone":
case "server.user.domain":
case "ServerUserDomain":
case "server.user.email":
case "ServerUserEmail":
case "server.user.full_name":
case "ServerUserFullName":
case "server.user.hash":
case "ServerUserHash":
case "server.user.id":
case "ServerUserId":
case "server.user.name":
case "ServerUserName":
case "server.user.group.domain":
case "ServerUserGroupDomain":
case "server.user.group.id":
case "ServerUserGroupId":
case "server.user.group.name":
case "ServerUserGroupName":
case "server.user.risk.calculated_level":
case "ServerUserRiskCalculatedLevel":
case "server.user.risk.calculated_score":
case "ServerUserRiskCalculatedScore":
case "server.user.risk.calculated_score_norm":
case "ServerUserRiskCalculatedScoreNorm":
case "server.user.risk.static_level":
case "ServerUserRiskStaticLevel":
case "server.user.risk.static_score":
case "ServerUserRiskStaticScore":
case "server.user.risk.static_score_norm":
case "ServerUserRiskStaticScoreNorm":
return TrySetServer(document, path, value);
case "service.address":
case "ServiceAddress":
case "service.environment":
case "ServiceEnvironment":
case "service.ephemeral_id":
case "ServiceEphemeralId":
case "service.id":
case "ServiceId":
case "service.name":
case "ServiceName":
case "service.node.name":
case "ServiceNodeName":
case "service.node.role":
case "ServiceNodeRole":
case "service.state":
case "ServiceState":
case "service.type":
case "ServiceType":
case "service.version":
case "ServiceVersion":
return TrySetService(document, path, value);
case "source.address":
case "SourceAddress":
case "source.bytes":
case "SourceBytes":
case "source.domain":
case "SourceDomain":
case "source.ip":
case "SourceIp":
case "source.mac":
case "SourceMac":
case "source.nat.ip":
case "SourceNatIp":
case "source.nat.port":
case "SourceNatPort":
case "source.packets":
case "SourcePackets":
case "source.port":
case "SourcePort":
case "source.registered_domain":
case "SourceRegisteredDomain":
case "source.subdomain":
case "SourceSubdomain":
case "source.top_level_domain":
case "SourceTopLevelDomain":
case "source.as.number":
case "SourceAsNumber":
case "source.as.organization.name":
case "SourceAsOrganizationName":
case "source.geo.city_name":
case "SourceGeoCityName":
case "source.geo.continent_code":
case "SourceGeoContinentCode":
case "source.geo.continent_name":
case "SourceGeoContinentName":
case "source.geo.country_iso_code":
case "SourceGeoCountryIsoCode":
case "source.geo.country_name":
case "SourceGeoCountryName":
case "source.geo.location":
case "SourceGeoLocation":
case "source.geo.name":
case "SourceGeoName":
case "source.geo.postal_code":
case "SourceGeoPostalCode":
case "source.geo.region_iso_code":
case "SourceGeoRegionIsoCode":
case "source.geo.region_name":
case "SourceGeoRegionName":
case "source.geo.timezone":
case "SourceGeoTimezone":
case "source.user.domain":
case "SourceUserDomain":
case "source.user.email":
case "SourceUserEmail":
case "source.user.full_name":
case "SourceUserFullName":
case "source.user.hash":
case "SourceUserHash":
case "source.user.id":
case "SourceUserId":
case "source.user.name":
case "SourceUserName":
case "source.user.group.domain":
case "SourceUserGroupDomain":
case "source.user.group.id":
case "SourceUserGroupId":
case "source.user.group.name":
case "SourceUserGroupName":
case "source.user.risk.calculated_level":
case "SourceUserRiskCalculatedLevel":
case "source.user.risk.calculated_score":
case "SourceUserRiskCalculatedScore":
case "source.user.risk.calculated_score_norm":
case "SourceUserRiskCalculatedScoreNorm":
case "source.user.risk.static_level":
case "SourceUserRiskStaticLevel":
case "source.user.risk.static_score":
case "SourceUserRiskStaticScore":
case "source.user.risk.static_score_norm":
case "SourceUserRiskStaticScoreNorm":
return TrySetSource(document, path, value);
case "threat.feed.dashboard_id":
case "ThreatFeedDashboardId":
case "threat.feed.description":
case "ThreatFeedDescription":
case "threat.feed.name":
case "ThreatFeedName":
case "threat.feed.reference":
case "ThreatFeedReference":
case "threat.framework":
case "ThreatFramework":
case "threat.group.id":
case "ThreatGroupId":
case "threat.group.name":
case "ThreatGroupName":
case "threat.group.reference":
case "ThreatGroupReference":
case "threat.indicator.confidence":
case "ThreatIndicatorConfidence":
case "threat.indicator.description":
case "ThreatIndicatorDescription":
case "threat.indicator.email.address":
case "ThreatIndicatorEmailAddress":
case "threat.indicator.first_seen":
case "ThreatIndicatorFirstSeen":
case "threat.indicator.ip":
case "ThreatIndicatorIp":
case "threat.indicator.last_seen":
case "ThreatIndicatorLastSeen":
case "threat.indicator.marking.tlp":
case "ThreatIndicatorMarkingTlp":
case "threat.indicator.marking.tlp_version":
case "ThreatIndicatorMarkingTlpVersion":
case "threat.indicator.modified_at":
case "ThreatIndicatorModifiedAt":
case "threat.indicator.name":
case "ThreatIndicatorName":
case "threat.indicator.port":
case "ThreatIndicatorPort":
case "threat.indicator.provider":
case "ThreatIndicatorProvider":
case "threat.indicator.reference":
case "ThreatIndicatorReference":
case "threat.indicator.scanner_stats":
case "ThreatIndicatorScannerStats":
case "threat.indicator.sightings":
case "ThreatIndicatorSightings":
case "threat.indicator.type":
case "ThreatIndicatorType":
case "threat.software.id":
case "ThreatSoftwareId":
case "threat.software.name":
case "ThreatSoftwareName":
case "threat.software.reference":
case "ThreatSoftwareReference":
case "threat.software.type":
case "ThreatSoftwareType":
case "threat.indicator.x509.issuer.distinguished_name":
case "ThreatIndicatorX509IssuerDistinguishedName":
case "threat.indicator.x509.not_after":
case "ThreatIndicatorX509NotAfter":
case "threat.indicator.x509.not_before":
case "ThreatIndicatorX509NotBefore":
case "threat.indicator.x509.public_key_algorithm":
case "ThreatIndicatorX509PublicKeyAlgorithm":
case "threat.indicator.x509.public_key_curve":
case "ThreatIndicatorX509PublicKeyCurve":
case "threat.indicator.x509.public_key_exponent":
case "ThreatIndicatorX509PublicKeyExponent":
case "threat.indicator.x509.public_key_size":
case "ThreatIndicatorX509PublicKeySize":
case "threat.indicator.x509.serial_number":
case "ThreatIndicatorX509SerialNumber":
case "threat.indicator.x509.signature_algorithm":
case "ThreatIndicatorX509SignatureAlgorithm":
case "threat.indicator.x509.subject.distinguished_name":
case "ThreatIndicatorX509SubjectDistinguishedName":
case "threat.indicator.x509.version_number":
case "ThreatIndicatorX509VersionNumber":
case "threat.indicator.as.number":
case "ThreatIndicatorAsNumber":
case "threat.indicator.as.organization.name":
case "ThreatIndicatorAsOrganizationName":
case "threat.indicator.file.accessed":
case "ThreatIndicatorFileAccessed":
case "threat.indicator.file.created":
case "ThreatIndicatorFileCreated":
case "threat.indicator.file.ctime":
case "ThreatIndicatorFileCtime":
case "threat.indicator.file.device":
case "ThreatIndicatorFileDevice":
case "threat.indicator.file.directory":
case "ThreatIndicatorFileDirectory":
case "threat.indicator.file.drive_letter":
case "ThreatIndicatorFileDriveLetter":
case "threat.indicator.file.extension":
case "ThreatIndicatorFileExtension":
case "threat.indicator.file.fork_name":
case "ThreatIndicatorFileForkName":
case "threat.indicator.file.gid":
case "ThreatIndicatorFileGid":
case "threat.indicator.file.group":
case "ThreatIndicatorFileGroup":
case "threat.indicator.file.inode":
case "ThreatIndicatorFileInode":
case "threat.indicator.file.mime_type":
case "ThreatIndicatorFileMimeType":
case "threat.indicator.file.mode":
case "ThreatIndicatorFileMode":
case "threat.indicator.file.mtime":
case "ThreatIndicatorFileMtime":
case "threat.indicator.file.name":
case "ThreatIndicatorFileName":
case "threat.indicator.file.owner":
case "ThreatIndicatorFileOwner":
case "threat.indicator.file.path":
case "ThreatIndicatorFilePath":
case "threat.indicator.file.size":
case "ThreatIndicatorFileSize":
case "threat.indicator.file.target_path":
case "ThreatIndicatorFileTargetPath":
case "threat.indicator.file.type":
case "ThreatIndicatorFileType":
case "threat.indicator.file.uid":
case "ThreatIndicatorFileUid":
case "threat.indicator.file.hash.md5":
case "ThreatIndicatorFileHashMd5":
case "threat.indicator.file.hash.sha1":
case "ThreatIndicatorFileHashSha1":
case "threat.indicator.file.hash.sha256":
case "ThreatIndicatorFileHashSha256":
case "threat.indicator.file.hash.sha384":
case "ThreatIndicatorFileHashSha384":
case "threat.indicator.file.hash.sha512":
case "ThreatIndicatorFileHashSha512":
case "threat.indicator.file.hash.ssdeep":
case "ThreatIndicatorFileHashSsdeep":
case "threat.indicator.file.hash.tlsh":
case "ThreatIndicatorFileHashTlsh":
case "threat.indicator.file.pe.architecture":
case "ThreatIndicatorFilePeArchitecture":
case "threat.indicator.file.pe.company":
case "ThreatIndicatorFilePeCompany":
case "threat.indicator.file.pe.description":
case "ThreatIndicatorFilePeDescription":
case "threat.indicator.file.pe.file_version":
case "ThreatIndicatorFilePeFileVersion":
case "threat.indicator.file.pe.go_import_hash":
case "ThreatIndicatorFilePeGoImportHash":
case "threat.indicator.file.pe.go_imports":
case "ThreatIndicatorFilePeGoImports":
case "threat.indicator.file.pe.go_imports_names_entropy":
case "ThreatIndicatorFilePeGoImportsNamesEntropy":
case "threat.indicator.file.pe.go_imports_names_var_entropy":
case "ThreatIndicatorFilePeGoImportsNamesVarEntropy":
case "threat.indicator.file.pe.go_stripped":
case "ThreatIndicatorFilePeGoStripped":
case "threat.indicator.file.pe.imphash":
case "ThreatIndicatorFilePeImphash":
case "threat.indicator.file.pe.import_hash":
case "ThreatIndicatorFilePeImportHash":
case "threat.indicator.file.pe.imports_names_entropy":
case "ThreatIndicatorFilePeImportsNamesEntropy":
case "threat.indicator.file.pe.imports_names_var_entropy":
case "ThreatIndicatorFilePeImportsNamesVarEntropy":
case "threat.indicator.file.pe.original_file_name":
case "ThreatIndicatorFilePeOriginalFileName":
case "threat.indicator.file.pe.pehash":
case "ThreatIndicatorFilePePehash":
case "threat.indicator.file.pe.product":
case "ThreatIndicatorFilePeProduct":
case "threat.indicator.file.x509.issuer.distinguished_name":
case "ThreatIndicatorFileX509IssuerDistinguishedName":
case "threat.indicator.file.x509.not_after":
case "ThreatIndicatorFileX509NotAfter":
case "threat.indicator.file.x509.not_before":
case "ThreatIndicatorFileX509NotBefore":
case "threat.indicator.file.x509.public_key_algorithm":
case "ThreatIndicatorFileX509PublicKeyAlgorithm":
case "threat.indicator.file.x509.public_key_curve":
case "ThreatIndicatorFileX509PublicKeyCurve":
case "threat.indicator.file.x509.public_key_exponent":
case "ThreatIndicatorFileX509PublicKeyExponent":
case "threat.indicator.file.x509.public_key_size":
case "ThreatIndicatorFileX509PublicKeySize":
case "threat.indicator.file.x509.serial_number":
case "ThreatIndicatorFileX509SerialNumber":
case "threat.indicator.file.x509.signature_algorithm":
case "ThreatIndicatorFileX509SignatureAlgorithm":
case "threat.indicator.file.x509.subject.distinguished_name":
case "ThreatIndicatorFileX509SubjectDistinguishedName":
case "threat.indicator.file.x509.version_number":
case "ThreatIndicatorFileX509VersionNumber":
case "threat.indicator.file.code_signature.digest_algorithm":
case "ThreatIndicatorFileCodeSignatureDigestAlgorithm":
case "threat.indicator.file.code_signature.exists":
case "ThreatIndicatorFileCodeSignatureExists":
case "threat.indicator.file.code_signature.signing_id":
case "ThreatIndicatorFileCodeSignatureSigningId":
case "threat.indicator.file.code_signature.status":
case "ThreatIndicatorFileCodeSignatureStatus":
case "threat.indicator.file.code_signature.subject_name":
case "ThreatIndicatorFileCodeSignatureSubjectName":
case "threat.indicator.file.code_signature.team_id":
case "ThreatIndicatorFileCodeSignatureTeamId":
case "threat.indicator.file.code_signature.timestamp":
case "ThreatIndicatorFileCodeSignatureTimestamp":
case "threat.indicator.file.code_signature.trusted":
case "ThreatIndicatorFileCodeSignatureTrusted":
case "threat.indicator.file.code_signature.valid":
case "ThreatIndicatorFileCodeSignatureValid":
case "threat.indicator.file.elf.architecture":
case "ThreatIndicatorFileElfArchitecture":
case "threat.indicator.file.elf.byte_order":
case "ThreatIndicatorFileElfByteOrder":
case "threat.indicator.file.elf.cpu_type":
case "ThreatIndicatorFileElfCpuType":
case "threat.indicator.file.elf.creation_date":
case "ThreatIndicatorFileElfCreationDate":
case "threat.indicator.file.elf.go_import_hash":
case "ThreatIndicatorFileElfGoImportHash":
case "threat.indicator.file.elf.go_imports":
case "ThreatIndicatorFileElfGoImports":
case "threat.indicator.file.elf.go_imports_names_entropy":
case "ThreatIndicatorFileElfGoImportsNamesEntropy":
case "threat.indicator.file.elf.go_imports_names_var_entropy":
case "ThreatIndicatorFileElfGoImportsNamesVarEntropy":
case "threat.indicator.file.elf.go_stripped":
case "ThreatIndicatorFileElfGoStripped":
case "threat.indicator.file.elf.header.abi_version":
case "ThreatIndicatorFileElfHeaderAbiVersion":
case "threat.indicator.file.elf.header.class":
case "ThreatIndicatorFileElfHeaderClass":
case "threat.indicator.file.elf.header.data":
case "ThreatIndicatorFileElfHeaderData":
case "threat.indicator.file.elf.header.entrypoint":
case "ThreatIndicatorFileElfHeaderEntrypoint":
case "threat.indicator.file.elf.header.object_version":
case "ThreatIndicatorFileElfHeaderObjectVersion":
case "threat.indicator.file.elf.header.os_abi":
case "ThreatIndicatorFileElfHeaderOsAbi":
case "threat.indicator.file.elf.header.type":
case "ThreatIndicatorFileElfHeaderType":
case "threat.indicator.file.elf.header.version":
case "ThreatIndicatorFileElfHeaderVersion":
case "threat.indicator.file.elf.import_hash":
case "ThreatIndicatorFileElfImportHash":
case "threat.indicator.file.elf.imports_names_entropy":
case "ThreatIndicatorFileElfImportsNamesEntropy":
case "threat.indicator.file.elf.imports_names_var_entropy":
case "ThreatIndicatorFileElfImportsNamesVarEntropy":
case "threat.indicator.file.elf.telfhash":
case "ThreatIndicatorFileElfTelfhash":
case "threat.indicator.file.macho.go_import_hash":
case "ThreatIndicatorFileMachoGoImportHash":
case "threat.indicator.file.macho.go_imports":
case "ThreatIndicatorFileMachoGoImports":
case "threat.indicator.file.macho.go_imports_names_entropy":
case "ThreatIndicatorFileMachoGoImportsNamesEntropy":
case "threat.indicator.file.macho.go_imports_names_var_entropy":
case "ThreatIndicatorFileMachoGoImportsNamesVarEntropy":
case "threat.indicator.file.macho.go_stripped":
case "ThreatIndicatorFileMachoGoStripped":
case "threat.indicator.file.macho.import_hash":
case "ThreatIndicatorFileMachoImportHash":
case "threat.indicator.file.macho.imports_names_entropy":
case "ThreatIndicatorFileMachoImportsNamesEntropy":
case "threat.indicator.file.macho.imports_names_var_entropy":
case "ThreatIndicatorFileMachoImportsNamesVarEntropy":
case "threat.indicator.file.macho.symhash":
case "ThreatIndicatorFileMachoSymhash":
case "threat.indicator.geo.city_name":
case "ThreatIndicatorGeoCityName":
case "threat.indicator.geo.continent_code":
case "ThreatIndicatorGeoContinentCode":
case "threat.indicator.geo.continent_name":
case "ThreatIndicatorGeoContinentName":
case "threat.indicator.geo.country_iso_code":
case "ThreatIndicatorGeoCountryIsoCode":
case "threat.indicator.geo.country_name":
case "ThreatIndicatorGeoCountryName":
case "threat.indicator.geo.location":
case "ThreatIndicatorGeoLocation":
case "threat.indicator.geo.name":
case "ThreatIndicatorGeoName":
case "threat.indicator.geo.postal_code":
case "ThreatIndicatorGeoPostalCode":
case "threat.indicator.geo.region_iso_code":
case "ThreatIndicatorGeoRegionIsoCode":
case "threat.indicator.geo.region_name":
case "ThreatIndicatorGeoRegionName":
case "threat.indicator.geo.timezone":
case "ThreatIndicatorGeoTimezone":
case "threat.indicator.registry.data.bytes":
case "ThreatIndicatorRegistryDataBytes":
case "threat.indicator.registry.data.type":
case "ThreatIndicatorRegistryDataType":
case "threat.indicator.registry.hive":
case "ThreatIndicatorRegistryHive":
case "threat.indicator.registry.key":
case "ThreatIndicatorRegistryKey":
case "threat.indicator.registry.path":
case "ThreatIndicatorRegistryPath":
case "threat.indicator.registry.value":
case "ThreatIndicatorRegistryValue":
case "threat.indicator.url.domain":
case "ThreatIndicatorUrlDomain":
case "threat.indicator.url.extension":
case "ThreatIndicatorUrlExtension":
case "threat.indicator.url.fragment":
case "ThreatIndicatorUrlFragment":
case "threat.indicator.url.full":
case "ThreatIndicatorUrlFull":
case "threat.indicator.url.original":
case "ThreatIndicatorUrlOriginal":
case "threat.indicator.url.password":
case "ThreatIndicatorUrlPassword":
case "threat.indicator.url.path":
case "ThreatIndicatorUrlPath":
case "threat.indicator.url.port":
case "ThreatIndicatorUrlPort":
case "threat.indicator.url.query":
case "ThreatIndicatorUrlQuery":
case "threat.indicator.url.registered_domain":
case "ThreatIndicatorUrlRegisteredDomain":
case "threat.indicator.url.scheme":
case "ThreatIndicatorUrlScheme":
case "threat.indicator.url.subdomain":
case "ThreatIndicatorUrlSubdomain":
case "threat.indicator.url.top_level_domain":
case "ThreatIndicatorUrlTopLevelDomain":
case "threat.indicator.url.username":
case "ThreatIndicatorUrlUsername":
return TrySetThreat(document, path, value);
case "tls.cipher":
case "TlsCipher":
case "tls.client.certificate":
case "TlsClientCertificate":
case "tls.client.hash.md5":
case "TlsClientHashMd5":
case "tls.client.hash.sha1":
case "TlsClientHashSha1":
case "tls.client.hash.sha256":
case "TlsClientHashSha256":
case "tls.client.issuer":
case "TlsClientIssuer":
case "tls.client.ja3":
case "TlsClientJa3":
case "tls.client.not_after":
case "TlsClientNotAfter":
case "tls.client.not_before":
case "TlsClientNotBefore":
case "tls.client.server_name":
case "TlsClientServerName":
case "tls.client.subject":
case "TlsClientSubject":
case "tls.curve":
case "TlsCurve":
case "tls.established":
case "TlsEstablished":
case "tls.next_protocol":
case "TlsNextProtocol":
case "tls.resumed":
case "TlsResumed":
case "tls.server.certificate":
case "TlsServerCertificate":
case "tls.server.hash.md5":
case "TlsServerHashMd5":
case "tls.server.hash.sha1":
case "TlsServerHashSha1":
case "tls.server.hash.sha256":
case "TlsServerHashSha256":
case "tls.server.issuer":
case "TlsServerIssuer":
case "tls.server.ja3s":
case "TlsServerJa3s":
case "tls.server.not_after":
case "TlsServerNotAfter":
case "tls.server.not_before":
case "TlsServerNotBefore":
case "tls.server.subject":
case "TlsServerSubject":
case "tls.version":
case "TlsVersion":
case "tls.version_protocol":
case "TlsVersionProtocol":
case "tls.client.x509.issuer.distinguished_name":
case "TlsClientX509IssuerDistinguishedName":
case "tls.client.x509.not_after":
case "TlsClientX509NotAfter":
case "tls.client.x509.not_before":
case "TlsClientX509NotBefore":
case "tls.client.x509.public_key_algorithm":
case "TlsClientX509PublicKeyAlgorithm":
case "tls.client.x509.public_key_curve":
case "TlsClientX509PublicKeyCurve":
case "tls.client.x509.public_key_exponent":
case "TlsClientX509PublicKeyExponent":
case "tls.client.x509.public_key_size":
case "TlsClientX509PublicKeySize":
case "tls.client.x509.serial_number":
case "TlsClientX509SerialNumber":
case "tls.client.x509.signature_algorithm":
case "TlsClientX509SignatureAlgorithm":
case "tls.client.x509.subject.distinguished_name":
case "TlsClientX509SubjectDistinguishedName":
case "tls.client.x509.version_number":
case "TlsClientX509VersionNumber":
return TrySetTls(document, path, value);
case "url.domain":
case "UrlDomain":
case "url.extension":
case "UrlExtension":
case "url.fragment":
case "UrlFragment":
case "url.full":
case "UrlFull":
case "url.original":
case "UrlOriginal":
case "url.password":
case "UrlPassword":
case "url.path":
case "UrlPath":
case "url.port":
case "UrlPort":
case "url.query":
case "UrlQuery":
case "url.registered_domain":
case "UrlRegisteredDomain":
case "url.scheme":
case "UrlScheme":
case "url.subdomain":
case "UrlSubdomain":
case "url.top_level_domain":
case "UrlTopLevelDomain":
case "url.username":
case "UrlUsername":
return TrySetUrl(document, path, value);
case "user.domain":
case "UserDomain":
case "user.email":
case "UserEmail":
case "user.full_name":
case "UserFullName":
case "user.hash":
case "UserHash":
case "user.id":
case "UserId":
case "user.name":
case "UserName":
case "user.group.domain":
case "UserGroupDomain":
case "user.group.id":
case "UserGroupId":
case "user.group.name":
case "UserGroupName":
case "user.risk.calculated_level":
case "UserRiskCalculatedLevel":
case "user.risk.calculated_score":
case "UserRiskCalculatedScore":
case "user.risk.calculated_score_norm":
case "UserRiskCalculatedScoreNorm":
case "user.risk.static_level":
case "UserRiskStaticLevel":
case "user.risk.static_score":
case "UserRiskStaticScore":
case "user.risk.static_score_norm":
case "UserRiskStaticScoreNorm":
return TrySetUser(document, path, value);
case "user_agent.device.name":
case "UserAgentDeviceName":
case "user_agent.name":
case "UserAgentName":
case "user_agent.original":
case "UserAgentOriginal":
case "user_agent.version":
case "UserAgentVersion":
case "user_agent.os.family":
case "UserAgentOsFamily":
case "user_agent.os.full":
case "UserAgentOsFull":
case "user_agent.os.kernel":
case "UserAgentOsKernel":
case "user_agent.os.name":
case "UserAgentOsName":
case "user_agent.os.platform":
case "UserAgentOsPlatform":
case "user_agent.os.type":
case "UserAgentOsType":
case "user_agent.os.version":
case "UserAgentOsVersion":
return TrySetUserAgent(document, path, value);
case "vlan.id":
case "VlanId":
case "vlan.name":
case "VlanName":
return TrySetVlan(document, path, value);
case "vulnerability.classification":
case "VulnerabilityClassification":
case "vulnerability.description":
case "VulnerabilityDescription":
case "vulnerability.enumeration":
case "VulnerabilityEnumeration":
case "vulnerability.id":
case "VulnerabilityId":
case "vulnerability.reference":
case "VulnerabilityReference":
case "vulnerability.report_id":
case "VulnerabilityReportId":
case "vulnerability.scanner.vendor":
case "VulnerabilityScannerVendor":
case "vulnerability.score.base":
case "VulnerabilityScoreBase":
case "vulnerability.score.environmental":
case "VulnerabilityScoreEnvironmental":
case "vulnerability.score.temporal":
case "VulnerabilityScoreTemporal":
case "vulnerability.score.version":
case "VulnerabilityScoreVersion":
case "vulnerability.severity":
case "VulnerabilitySeverity":
return TrySetVulnerability(document, path, value);
case "x509.issuer.distinguished_name":
case "X509IssuerDistinguishedName":
case "x509.not_after":
case "X509NotAfter":
case "x509.not_before":
case "X509NotBefore":
case "x509.public_key_algorithm":
case "X509PublicKeyAlgorithm":
case "x509.public_key_curve":
case "X509PublicKeyCurve":
case "x509.public_key_exponent":
case "X509PublicKeyExponent":
case "x509.public_key_size":
case "X509PublicKeySize":
case "x509.serial_number":
case "X509SerialNumber":
case "x509.signature_algorithm":
case "X509SignatureAlgorithm":
case "x509.subject.distinguished_name":
case "X509SubjectDistinguishedName":
case "x509.version_number":
case "X509VersionNumber":
return TrySetX509(document, path, value);
default:
return false;
}
}