schemas/v1/process/process.yaml

'@timestamp':
  dashed_name: timestamp
  description: 'Date/time when the event originated.

    This is the date/time extracted from the event, typically representing when the
    event was generated by the source.

    If the event source has no original timestamp, this value is typically populated
    by the first time the event was received by the pipeline.

    Required field for all events.'
  example: '2016-05-23T08:05:34.853Z'
  flat_name: '@timestamp'
  level: core
  name: '@timestamp'
  normalize: []
  required: true
  short: Date/time when the event originated.
  type: date
agent.id:
  dashed_name: agent-id
  description: 'Unique identifier of this agent (if one exists).

    Example: For Beats this would be beat.id.'
  example: 8a4f500d
  flat_name: agent.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique identifier of this agent.
  type: keyword
agent.type:
  dashed_name: agent-type
  description: 'Type of the agent.

    The agent type always stays the same and should be given by the agent used. In
    case of Filebeat the agent would always be Filebeat also if two Filebeat instances
    are run on the same machine.'
  example: filebeat
  flat_name: agent.type
  ignore_above: 1024
  level: core
  name: type
  normalize: []
  short: Type of the agent.
  type: keyword
agent.version:
  dashed_name: agent-version
  description: Version of the agent.
  example: 6.0.0-rc2
  flat_name: agent.version
  ignore_above: 1024
  level: core
  name: version
  normalize: []
  short: Version of the agent.
  type: keyword
data_stream.dataset:
  dashed_name: data-stream-dataset
  description: Data stream dataset name.
  example: nginx.access
  flat_name: data_stream.dataset
  level: custom
  name: dataset
  normalize: []
  short: The field can contain anything that makes sense to signify the source of
    the data.
  type: constant_keyword
data_stream.namespace:
  dashed_name: data-stream-namespace
  description: Data stream namespace.
  example: production
  flat_name: data_stream.namespace
  level: custom
  name: namespace
  normalize: []
  short: A user defined namespace. Namespaces are useful to allow grouping of data.
  type: constant_keyword
data_stream.type:
  dashed_name: data-stream-type
  description: Data stream type.
  example: logs
  flat_name: data_stream.type
  level: custom
  name: type
  normalize: []
  short: An overarching type for the data stream.
  type: constant_keyword
destination.geo.city_name:
  dashed_name: destination-geo-city-name
  description: City name.
  example: Montreal
  flat_name: destination.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
destination.geo.continent_code:
  dashed_name: destination-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: destination.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
destination.geo.continent_name:
  dashed_name: destination-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: destination.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
destination.geo.country_iso_code:
  dashed_name: destination-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: destination.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
destination.geo.country_name:
  dashed_name: destination-geo-country-name
  description: Country name.
  example: Canada
  flat_name: destination.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
destination.geo.location:
  dashed_name: destination-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: destination.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
destination.geo.name:
  dashed_name: destination-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: destination.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
destination.geo.postal_code:
  dashed_name: destination-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: destination.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
destination.geo.region_iso_code:
  dashed_name: destination-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: destination.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
destination.geo.region_name:
  dashed_name: destination-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: destination.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
destination.geo.timezone:
  dashed_name: destination-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: destination.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
ecs.version:
  dashed_name: ecs-version
  description: 'ECS version this event conforms to. `ecs.version` is a required field
    and must exist in all events.

    When querying across multiple indices -- which may conform to slightly different
    ECS versions -- this field lets integrations adjust to the schema version of the
    events.'
  example: 1.0.0
  flat_name: ecs.version
  ignore_above: 1024
  level: core
  name: version
  normalize: []
  required: true
  short: ECS version this event conforms to.
  type: keyword
event.action:
  dashed_name: event-action
  description: 'The action captured by the event.

    This describes the information in the event. It is more specific than `event.category`.
    Examples are `group-add`, `process-started`, `file-created`. The value is normally
    defined by the implementer.'
  example: user-password-change
  flat_name: event.action
  ignore_above: 1024
  level: core
  name: action
  normalize: []
  short: The action captured by the event.
  type: keyword
event.category:
  allowed_values:
  - description: Events in this category annotate API calls that occured on a system.
      Typical sources for those events could be from the Operating System level through
      the native libraries (for example Windows Win32, Linux libc, etc.), or managed
      sources of events (such as ETW, syslog), but can also include network protocols
      (such as SOAP, RPC, Websocket, REST, etc.)
    expected_event_types:
    - access
    - admin
    - allowed
    - change
    - creation
    - deletion
    - denied
    - end
    - info
    - start
    - user
    name: api
  - description: Events in this category are related to the challenge and response
      process in which credentials are supplied and verified to allow the creation
      of a session. Common sources for these logs are Windows event logs and ssh logs.
      Visualize and analyze events in this category to look for failed logins, and
      other authentication-related activity.
    expected_event_types:
    - start
    - end
    - info
    name: authentication
  - description: 'Events in the configuration category have to deal with creating,
      modifying, or deleting the settings or parameters of an application, process,
      or system.

      Example sources include security policy change logs, configuration auditing
      logging, and system integrity monitoring.'
    expected_event_types:
    - access
    - change
    - creation
    - deletion
    - info
    name: configuration
  - description: The database category denotes events and metrics relating to a data
      storage and retrieval system. Note that use of this category is not limited
      to relational database systems. Examples include event logs from MS SQL, MySQL,
      Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database
      activity such as accesses and changes.
    expected_event_types:
    - access
    - change
    - info
    - error
    name: database
  - description: 'Events in the driver category have to do with operating system device
      drivers and similar software entities such as Windows drivers, kernel extensions,
      kernel modules, etc.

      Use events and metrics in this category to visualize and analyze driver-related
      activity and status on hosts.'
    expected_event_types:
    - change
    - end
    - info
    - start
    name: driver
  - description: 'This category is used for events relating to email messages, email
      attachments, and email network or protocol activity.

      Emails events can be produced by email security gateways, mail transfer agents,
      email cloud service providers, or mail server monitoring applications.'
    expected_event_types:
    - info
    name: email
  - description: Relating to a set of information that has been created on, or has
      existed on a filesystem. Use this category of events to visualize and analyze
      the creation, access, and deletions of files. Events in this category can come
      from both host-based and network-based sources. An example source of a network-based
      detection of a file transfer would be the Zeek file.log.
    expected_event_types:
    - access
    - change
    - creation
    - deletion
    - info
    name: file
  - description: 'Use this category to visualize and analyze information such as host
      inventory or host lifecycle events.

      Most of the events in this category can usually be observed from the outside,
      such as from a hypervisor or a control plane''s point of view. Some can also
      be seen from within, such as "start" or "end".

      Note that this category is for information about hosts themselves; it is not
      meant to capture activity "happening on a host".'
    expected_event_types:
    - access
    - change
    - end
    - info
    - start
    name: host
  - description: Identity and access management (IAM) events relating to users, groups,
      and administration. Use this category to visualize and analyze IAM-related logs
      and data from active directory, LDAP, Okta, Duo, and other IAM systems.
    expected_event_types:
    - admin
    - change
    - creation
    - deletion
    - group
    - info
    - user
    name: iam
  - description: Relating to intrusion detections from IDS/IPS systems and functions,
      both network and host-based. Use this category to visualize and analyze intrusion
      detection alerts from systems such as Snort, Suricata, and Palo Alto threat
      detections.
    expected_event_types:
    - allowed
    - denied
    - info
    name: intrusion_detection
  - description: Events in this category refer to the loading of a library, such as
      (dll / so / dynlib), into a process. Use this category to visualize and analyze
      library loading related activity on hosts.  Keep in mind that driver related
      activity will be captured under the "driver" category above.
    expected_event_types:
    - start
    name: library
  - description: Malware detection events and alerts. Use this category to visualize
      and analyze malware detections from EDR/EPP systems such as Elastic Endpoint
      Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems
      such as Suricata, or other sources of malware-related events such as Palo Alto
      Networks threat logs and Wildfire logs.
    expected_event_types:
    - info
    name: malware
  - description: Relating to all network activity, including network connection lifecycle,
      network traffic, and essentially any event that includes an IP address. Many
      events containing decoded network protocol transactions fit into this category.
      Use events in this category to visualize or analyze counts of network ports,
      protocols, addresses, geolocation information, etc.
    expected_event_types:
    - access
    - allowed
    - connection
    - denied
    - end
    - info
    - protocol
    - start
    name: network
  - description: Relating to software packages installed on hosts. Use this category
      to visualize and analyze inventory of software installed on various hosts, or
      to determine host vulnerability in the absence of vulnerability scan data.
    expected_event_types:
    - access
    - change
    - deletion
    - info
    - installation
    - start
    name: package
  - description: Use this category of events to visualize and analyze process-specific
      information such as lifecycle events or process ancestry.
    expected_event_types:
    - access
    - change
    - end
    - info
    - start
    name: process
  - description: Having to do with settings and assets stored in the Windows registry.
      Use this category to visualize and analyze activity such as registry access
      and modifications.
    expected_event_types:
    - access
    - change
    - creation
    - deletion
    name: registry
  - description: The session category is applied to events and metrics regarding logical
      persistent connections to hosts and services. Use this category to visualize
      and analyze interactive or automated persistent connections between assets.
      Data for this category may come from Windows Event logs, SSH logs, or stateless
      sessions such as HTTP cookie-based sessions, etc.
    expected_event_types:
    - start
    - end
    - info
    name: session
  - description: Use this category to visualize and analyze events describing threat
      actors' targets, motives, or behaviors.
    expected_event_types:
    - indicator
    name: threat
  - description: Relating to vulnerability scan results. Use this category to analyze
      vulnerabilities detected by Tenable, Qualys, internal scanners, and other vulnerability
      management sources.
    expected_event_types:
    - info
    name: vulnerability
  - description: 'Relating to web server access. Use this category to create a dashboard
      of web server/proxy activity from apache, IIS, nginx web servers, etc. Note:
      events from network observers such as Zeek http log may also be included in
      this category.'
    expected_event_types:
    - access
    - error
    - info
    name: web
  dashed_name: event-category
  description: 'This is one of four ECS Categorization Fields, and indicates the second
    level in the ECS category hierarchy.

    `event.category` represents the "big buckets" of ECS categories. For example,
    filtering on `event.category:process` yields all events relating to process activity.
    This field is closely related to `event.type`, which is used as a subcategory.

    This field is an array. This will allow proper categorization of some events that
    fall in multiple categories.'
  example: authentication
  flat_name: event.category
  ignore_above: 1024
  level: core
  name: category
  normalize:
  - array
  short: Event category. The second categorization field in the hierarchy.
  type: keyword
event.code:
  dashed_name: event-code
  description: 'Identification code for this event, if one exists.

    Some event sources use event codes to identify messages unambiguously, regardless
    of message language or wording adjustments over time. An example of this is the
    Windows Event ID.'
  example: 4648
  flat_name: event.code
  ignore_above: 1024
  level: extended
  name: code
  normalize: []
  short: Identification code for this event.
  type: keyword
event.created:
  dashed_name: event-created
  description: '`event.created` contains the date/time when the event was first read
    by an agent, or by your pipeline.

    This field is distinct from `@timestamp` in that `@timestamp` typically contain
    the time extracted from the original event.

    In most situations, these two timestamps will be slightly different. The difference
    can be used to calculate the delay between your source generating an event, and
    the time when your agent first processed it. This can be used to monitor your
    agent''s or pipeline''s ability to keep up with your event source.

    In case the two timestamps are identical, `@timestamp` should be used.'
  example: '2016-05-23T08:05:34.857Z'
  flat_name: event.created
  level: core
  name: created
  normalize: []
  short: Time when the event was first read by an agent or by your pipeline.
  type: date
event.dataset:
  dashed_name: event-dataset
  description: 'Name of the dataset.

    If an event source publishes more than one type of log or events (e.g. access
    log, error log), the dataset is used to specify which one the event comes from.

    It''s recommended but not required to start the dataset name with the module name,
    followed by a dot, then the dataset name.'
  example: apache.access
  flat_name: event.dataset
  ignore_above: 1024
  level: core
  name: dataset
  normalize: []
  short: Name of the dataset.
  type: keyword
event.hash:
  dashed_name: event-hash
  description: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate
    log integrity.
  example: 123456789012345678901234567890ABCD
  flat_name: event.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  short: Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate
    log integrity.
  type: keyword
event.id:
  dashed_name: event-id
  description: Unique ID to describe the event.
  example: 8a4f500d
  flat_name: event.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique ID to describe the event.
  type: keyword
event.ingested:
  dashed_name: event-ingested
  description: 'Timestamp when an event arrived in the central data store.

    This is different from `@timestamp`, which is when the event originally occurred.  It''s
    also different from `event.created`, which is meant to capture the first time
    an agent saw the event.

    In normal conditions, assuming no tampering, the timestamps should chronologically
    look like this: `@timestamp` < `event.created` < `event.ingested`.'
  example: '2016-05-23T08:05:35.101Z'
  flat_name: event.ingested
  level: core
  name: ingested
  normalize: []
  short: Timestamp when an event arrived in the central data store.
  type: date
event.kind:
  allowed_values:
  - description: 'This value indicates an event such as an alert or notable event,
      triggered by a detection rule executing externally to the Elastic Stack.

      `event.kind:alert` is often populated for events coming from firewalls, intrusion
      detection systems, endpoint detection and response systems, and so on.

      This value is not used by Elastic solutions for alert documents that are created
      by rules executing within the Kibana alerting framework.'
    name: alert
  - beta: This event categorization value is beta and subject to change.
    description: 'This value indicates events whose primary purpose is to store an
      inventory of assets/entities and their attributes. Assets/entities are objects
      (such as users and hosts) that are expected to be subjects of detailed analysis
      within the system.

      Examples include lists of user identities or accounts ingested from directory
      services such as Active Directory (AD), inventory of hosts pulled from configuration
      management databases (CMDB), and lists of cloud storage buckets pulled from
      cloud provider APIs.

      This value is used by Elastic Security for asset management solutions. `event.kind:
      asset` is not used for normal system events or logs that are coming from an
      asset/entity, nor is it used for system events or logs coming from a directory
      or CMDB system.'
    name: asset
  - description: 'The `enrichment` value indicates an event collected to provide additional
      context, often to other events.

      An example is collecting indicators of compromise (IOCs) from a threat intelligence
      provider with the intent to use those values to enrich other events. The IOC
      events from the intelligence provider should be categorized as `event.kind:enrichment`.'
    name: enrichment
  - description: This value is the most general and most common value for this field.
      It is used to represent events that indicate that something happened.
    name: event
  - description: 'This value is used to indicate that this event describes a numeric
      measurement taken at given point in time.

      Examples include CPU utilization, memory usage, or device temperature.

      Metric events are often collected on a predictable frequency, such as once every
      few seconds, or once a minute, but can also be used to describe ad-hoc numeric
      metric queries.'
    name: metric
  - description: 'The state value is similar to metric, indicating that this event
      describes a measurement taken at given point in time, except that the measurement
      does not result in a numeric value, but rather one of a fixed set of categorical
      values that represent conditions or states.

      Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red),
      the state of a TCP connection (open, closed, fin_wait, etc.), the state of a
      host with respect to a software vulnerability (vulnerable, not vulnerable),
      and the state of a system regarding compliance with a regulatory standard (compliant,
      not compliant).

      Note that an event that describes a change of state would not use `event.kind:state`,
      but instead would use ''event.kind:event'' since a state change fits the more
      general event definition of something that happened.

      State events are often collected on a predictable frequency, such as once every
      few seconds, once a minute, once an hour, or once a day, but can also be used
      to describe ad-hoc state queries.'
    name: state
  - description: This value indicates that an error occurred during the ingestion
      of this event, and that event data may be missing, inconsistent, or incorrect.
      `event.kind:pipeline_error` is often associated with parsing errors.
    name: pipeline_error
  - description: 'This value is used by Elastic solutions (e.g., Security, Observability)
      for alert documents that are created by rules executing within the Kibana alerting
      framework.

      Usage of this value is reserved, and data ingestion pipelines must not populate
      `event.kind` with the value "signal".'
    name: signal
  dashed_name: event-kind
  description: 'This is one of four ECS Categorization Fields, and indicates the highest
    level in the ECS category hierarchy.

    `event.kind` gives high-level information about what type of information the event
    contains, without being specific to the contents of the event. For example, values
    of this field distinguish alert events from metric events.

    The value of this field can be used to inform how these kinds of events should
    be handled. They may warrant different retention, different access control, it
    may also help understand whether the data is coming in at a regular interval or
    not.'
  example: alert
  flat_name: event.kind
  ignore_above: 1024
  level: core
  name: kind
  normalize: []
  short: The kind of the event. The highest categorization field in the hierarchy.
  type: keyword
event.module:
  dashed_name: event-module
  description: 'Name of the module this data is coming from.

    If your monitoring agent supports the concept of modules or plugins to process
    events of a given source (e.g. Apache logs), `event.module` should contain the
    name of this module.'
  example: apache
  flat_name: event.module
  ignore_above: 1024
  level: core
  name: module
  normalize: []
  short: Name of the module this data is coming from.
  type: keyword
event.outcome:
  allowed_values:
  - description: Indicates that this event describes a failed result. A common example
      is `event.category:file AND event.type:access AND event.outcome:failure` to
      indicate that a file access was attempted, but was not successful.
    name: failure
  - description: Indicates that this event describes a successful result. A common
      example is `event.category:file AND event.type:create AND event.outcome:success`
      to indicate that a file was successfully created.
    name: success
  - description: Indicates that this event describes only an attempt for which the
      result is unknown from the perspective of the event producer. For example, if
      the event contains information only about the request side of a transaction
      that results in a response, populating `event.outcome:unknown` in the request
      event is appropriate. The unknown value should not be used when an outcome doesn't
      make logical sense for the event. In such cases `event.outcome` should not be
      populated.
    name: unknown
  dashed_name: event-outcome
  description: 'This is one of four ECS Categorization Fields, and indicates the lowest
    level in the ECS category hierarchy.

    `event.outcome` simply denotes whether the event represents a success or a failure
    from the perspective of the entity that produced the event.

    Note that when a single transaction is described in multiple events, each event
    may populate different values of `event.outcome`, according to their perspective.

    Also note that in the case of a compound event (a single event that contains multiple
    logical events), this field should be populated with the value that best captures
    the overall success or failure from the perspective of the event producer.

    Further note that not all events will have an associated outcome. For example,
    this field is generally not populated for metric events, events with `event.type:info`,
    or any events for which an outcome does not make logical sense.'
  example: success
  flat_name: event.outcome
  ignore_above: 1024
  level: core
  name: outcome
  normalize: []
  short: The outcome of the event. The lowest level categorization field in the hierarchy.
  type: keyword
event.provider:
  dashed_name: event-provider
  description: 'Source of the event.

    Event transports such as Syslog or the Windows Event Log typically mention the
    source of an event. It can be the name of the software that generated the event
    (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).'
  example: kernel
  flat_name: event.provider
  ignore_above: 1024
  level: extended
  name: provider
  normalize: []
  short: Source of the event.
  type: keyword
event.sequence:
  dashed_name: event-sequence
  description: 'Sequence number of the event.

    The sequence number is a value published by some event sources, to make the exact
    ordering of events unambiguous, regardless of the timestamp precision.'
  flat_name: event.sequence
  format: string
  level: extended
  name: sequence
  normalize: []
  short: Sequence number of the event.
  type: long
event.severity:
  dashed_name: event-severity
  description: 'The numeric severity of the event according to your event source.

    What the different severity values mean can be different between sources and use
    cases. It''s up to the implementer to make sure severities are consistent across
    events from the same source.

    The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is
    meant to represent the severity according to the event source (e.g. firewall,
    IDS). If the event source does not publish its own severity, you may optionally
    copy the `log.syslog.severity.code` to `event.severity`.'
  example: 7
  flat_name: event.severity
  format: string
  level: core
  name: severity
  normalize: []
  short: Numeric severity of the event.
  type: long
event.type:
  allowed_values:
  - description: The access event type is used for the subset of events within a category
      that indicate that something was accessed. Common examples include `event.category:database
      AND event.type:access`, or `event.category:file AND event.type:access`. Note
      for file access, both directory listings and file opens should be included in
      this subcategory. You can further distinguish access operations using the ECS
      `event.action` field.
    name: access
  - description: 'The admin event type is used for the subset of events within a category
      that are related to admin objects. For example, administrative changes within
      an IAM framework that do not specifically affect a user or group (e.g., adding
      new applications to a federation solution or connecting discrete forests in
      Active Directory) would fall into this subcategory. Common example: `event.category:iam
      AND event.type:change AND event.type:admin`. You can further distinguish admin
      operations using the ECS `event.action` field.'
    name: admin
  - description: The allowed event type is used for the subset of events within a
      category that indicate that something was allowed. Common examples include `event.category:network
      AND event.type:connection AND event.type:allowed` (to indicate a network firewall
      event for which the firewall disposition was to allow the connection to complete)
      and `event.category:intrusion_detection AND event.type:allowed` (to indicate
      a network intrusion prevention system event for which the IPS disposition was
      to allow the connection to complete). You can further distinguish allowed operations
      using the ECS `event.action` field, populating with values of your choosing,
      such as "allow", "detect", or "pass".
    name: allowed
  - description: The change event type is used for the subset of events within a category
      that indicate that something has changed. If semantics best describe an event
      as modified, then include them in this subcategory. Common examples include
      `event.category:process AND event.type:change`, and `event.category:file AND
      event.type:change`. You can further distinguish change operations using the
      ECS `event.action` field.
    name: change
  - description: Used primarily with `event.category:network` this value is used for
      the subset of network traffic that includes sufficient information for the event
      to be included in flow or connection analysis. Events in this subcategory will
      contain at least source and destination IP addresses, source and destination
      TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred.
      Events in this subcategory may contain unidirectional or bidirectional information,
      including summary information. Use this subcategory to visualize and analyze
      network connections. Flow analysis, including Netflow, IPFIX, and other flow-related
      events fit in this subcategory. Note that firewall events from many Next-Generation
      Firewall (NGFW) devices will also fit into this subcategory.  A common filter
      for flow/connection information would be `event.category:network AND event.type:connection
      AND event.type:end` (to view or analyze all completed network connections, ignoring
      mid-flow reports). You can further distinguish connection events using the ECS
      `event.action` field, populating with values of your choosing, such as "timeout",
      or "reset".
    name: connection
  - description: The "creation" event type is used for the subset of events within
      a category that indicate that something was created. A common example is `event.category:file
      AND event.type:creation`.
    name: creation
  - description: The deletion event type is used for the subset of events within a
      category that indicate that something was deleted. A common example is `event.category:file
      AND event.type:deletion` to indicate that a file has been deleted.
    name: deletion
  - description: The denied event type is used for the subset of events within a category
      that indicate that something was denied. Common examples include `event.category:network
      AND event.type:denied` (to indicate a network firewall event for which the firewall
      disposition was to deny the connection) and `event.category:intrusion_detection
      AND event.type:denied` (to indicate a network intrusion prevention system event
      for which the IPS disposition was to deny the connection to complete). You can
      further distinguish denied operations using the ECS `event.action` field, populating
      with values of your choosing, such as "blocked", "dropped", or "quarantined".
    name: denied
  - description: The end event type is used for the subset of events within a category
      that indicate something has ended. A common example is `event.category:process
      AND event.type:end`.
    name: end
  - description: The error event type is used for the subset of events within a category
      that indicate or describe an error. A common example is `event.category:database
      AND event.type:error`. Note that pipeline errors that occur during the event
      ingestion process should not use this `event.type` value. Instead, they should
      use `event.kind:pipeline_error`.
    name: error
  - description: 'The group event type is used for the subset of events within a category
      that are related to group objects. Common example: `event.category:iam AND event.type:creation
      AND event.type:group`. You can further distinguish group operations using the
      ECS `event.action` field.'
    name: group
  - description: 'The indicator event type is used for the subset of events within
      a category that contain details about indicators of compromise (IOCs).

      A common example is `event.category:threat AND event.type:indicator`.'
    name: indicator
  - description: The info event type is used for the subset of events within a category
      that indicate that they are purely informational, and don't report a state change,
      or any type of action. For example, an initial run of a file integrity monitoring
      system (FIM), where an agent reports all files under management, would fall
      into the "info" subcategory. Similarly, an event containing a dump of all currently
      running processes (as opposed to reporting that a process started/ended) would
      fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection
      AND event.type:info`.
    name: info
  - description: The installation event type is used for the subset of events within
      a category that indicate that something was installed. A common example is `event.category:package`
      AND `event.type:installation`.
    name: installation
  - description: The protocol event type is used for the subset of events within a
      category that indicate that they contain protocol details or analysis, beyond
      simply identifying the protocol. Generally, network events that contain specific
      protocol details will fall into this subcategory. A common example is `event.category:network
      AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate
      that the event is a network connection event sent at the end of a connection
      that also includes a protocol detail breakdown). Note that events that only
      indicate the name or id of the protocol should not use the protocol value. Further
      note that when the protocol subcategory is used, the identified protocol is
      populated in the ECS `network.protocol` field.
    name: protocol
  - description: The start event type is used for the subset of events within a category
      that indicate something has started. A common example is `event.category:process
      AND event.type:start`.
    name: start
  - description: 'The user event type is used for the subset of events within a category
      that are related to user objects. Common example: `event.category:iam AND event.type:deletion
      AND event.type:user`. You can further distinguish user operations using the
      ECS `event.action` field.'
    name: user
  dashed_name: event-type
  description: 'This is one of four ECS Categorization Fields, and indicates the third
    level in the ECS category hierarchy.

    `event.type` represents a categorization "sub-bucket" that, when used along with
    the `event.category` field values, enables filtering events down to a level appropriate
    for single visualization.

    This field is an array. This will allow proper categorization of some events that
    fall in multiple event types.'
  flat_name: event.type
  ignore_above: 1024
  level: core
  name: type
  normalize:
  - array
  short: Event type. The third categorization field in the hierarchy.
  type: keyword
group.Ext:
  dashed_name: group-Ext
  description: Object for all custom defined fields to live in.
  flat_name: group.Ext
  level: custom
  name: Ext
  normalize: []
  short: Object for all custom defined fields to live in.
  type: object
group.Ext.real:
  dashed_name: group-Ext-real
  description: Group info prior to any setgid operations.
  flat_name: group.Ext.real
  level: custom
  name: Ext.real
  normalize: []
  short: Group info prior to any setgid operations.
  type: object
group.Ext.real.id:
  dashed_name: group-Ext-real-id
  description: Unique identifier for the group on the system/platform.
  flat_name: group.Ext.real.id
  ignore_above: 1024
  level: custom
  name: Ext.real.id
  normalize: []
  short: Unique identifier for the group on the system/platform.
  type: keyword
group.Ext.real.name:
  dashed_name: group-Ext-real-name
  description: Name of the group.
  flat_name: group.Ext.real.name
  ignore_above: 1024
  level: custom
  name: Ext.real.name
  normalize: []
  short: Name of the group.
  type: keyword
group.domain:
  dashed_name: group-domain
  description: Name of the directory the group is a member of. For example, an LDAP
    or Active Directory domain name.
  flat_name: group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  short: Name of the directory the group is a member of.
  type: keyword
group.id:
  dashed_name: group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  short: Unique identifier for the group on the system/platform.
  type: keyword
group.name:
  dashed_name: group-name
  description: Name of the group.
  flat_name: group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  short: Name of the group.
  type: keyword
host.architecture:
  dashed_name: host-architecture
  description: Operating system architecture.
  example: x86_64
  flat_name: host.architecture
  ignore_above: 1024
  level: core
  name: architecture
  normalize: []
  short: Operating system architecture.
  type: keyword
host.domain:
  dashed_name: host-domain
  description: 'Name of the domain of which the host is a member.

    For example, on Windows this could be the host''s Active Directory domain or NetBIOS
    domain name. For Linux this could be the domain of the host''s LDAP provider.'
  example: CONTOSO
  flat_name: host.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  short: Name of the directory the group is a member of.
  type: keyword
host.hostname:
  dashed_name: host-hostname
  description: 'Hostname of the host.

    It normally contains what the `hostname` command returns on the host machine.'
  flat_name: host.hostname
  ignore_above: 1024
  level: core
  name: hostname
  normalize: []
  short: Hostname of the host.
  type: keyword
host.id:
  dashed_name: host-id
  description: 'Unique host id.

    As hostname is not always unique, use values that are meaningful in your environment.

    Example: The current usage of `beat.name`.'
  flat_name: host.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique host id.
  type: keyword
host.ip:
  dashed_name: host-ip
  description: Host ip addresses.
  flat_name: host.ip
  level: core
  name: ip
  normalize:
  - array
  short: Host ip addresses.
  type: ip
host.mac:
  dashed_name: host-mac
  description: 'Host MAC addresses.

    The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte)
    is represented by two [uppercase] hexadecimal digits giving the value of the octet
    as an unsigned integer. Successive octets are separated by a hyphen.'
  example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
  flat_name: host.mac
  ignore_above: 1024
  level: core
  name: mac
  normalize:
  - array
  pattern: ^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$
  short: Host MAC addresses.
  type: keyword
host.name:
  dashed_name: host-name
  description: 'Name of the host.

    It can contain what hostname returns on Unix systems, the fully qualified domain
    name (FQDN), or a name specified by the user. The recommended value is the lowercase
    FQDN of the host.'
  flat_name: host.name
  ignore_above: 1024
  level: core
  name: name
  normalize: []
  short: Name of the host.
  type: keyword
host.os.Ext:
  dashed_name: host-os-Ext
  description: Object for all custom defined fields to live in.
  flat_name: host.os.Ext
  level: custom
  name: Ext
  normalize: []
  original_fieldset: os
  short: Object for all custom defined fields to live in.
  type: object
host.os.Ext.variant:
  dashed_name: host-os-Ext-variant
  description: A string value or phrase that further aid to classify or qualify the
    operating system (OS).  For example the distribution for a Linux OS will be entered
    in this field.
  example: Ubuntu
  flat_name: host.os.Ext.variant
  ignore_above: 1024
  level: custom
  name: Ext.variant
  normalize: []
  original_fieldset: os
  short: A string value or phrase that further aid to classify or qualify the operating
    system (OS).
  type: keyword
host.os.family:
  dashed_name: host-os-family
  description: OS family (such as redhat, debian, freebsd, windows).
  example: debian
  flat_name: host.os.family
  ignore_above: 1024
  level: extended
  name: family
  normalize: []
  original_fieldset: os
  short: OS family (such as redhat, debian, freebsd, windows).
  type: keyword
host.os.full:
  dashed_name: host-os-full
  description: Operating system name, including the version or code name.
  example: Mac OS Mojave
  flat_name: host.os.full
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: host.os.full.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: host.os.full.text
    name: text
    norms: false
    type: text
  name: full
  normalize: []
  original_fieldset: os
  short: Operating system name, including the version or code name.
  type: keyword
host.os.kernel:
  dashed_name: host-os-kernel
  description: Operating system kernel version as a raw string.
  example: 4.4.0-112-generic
  flat_name: host.os.kernel
  ignore_above: 1024
  level: extended
  name: kernel
  normalize: []
  original_fieldset: os
  short: Operating system kernel version as a raw string.
  type: keyword
host.os.name:
  dashed_name: host-os-name
  description: Operating system name, without the version.
  example: Mac OS X
  flat_name: host.os.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: host.os.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: host.os.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: os
  short: Operating system name, without the version.
  type: keyword
host.os.platform:
  dashed_name: host-os-platform
  description: Operating system platform (such centos, ubuntu, windows).
  example: darwin
  flat_name: host.os.platform
  ignore_above: 1024
  level: extended
  name: platform
  normalize: []
  original_fieldset: os
  short: Operating system platform (such centos, ubuntu, windows).
  type: keyword
host.os.type:
  dashed_name: host-os-type
  description: 'Use the `os.type` field to categorize the operating system into one
    of the broad commercial families.

    If the OS you''re dealing with is not listed as an expected value, the field should
    not be populated. Please let us know by opening an issue with ECS, to propose
    its addition.'
  example: macos
  expected_values:
  - linux
  - macos
  - unix
  - windows
  - ios
  - android
  flat_name: host.os.type
  ignore_above: 1024
  level: extended
  name: type
  normalize: []
  original_fieldset: os
  short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or
    android).'
  type: keyword
host.os.version:
  dashed_name: host-os-version
  description: Operating system version as a raw string.
  example: 10.14.1
  flat_name: host.os.version
  ignore_above: 1024
  level: extended
  name: version
  normalize: []
  original_fieldset: os
  short: Operating system version as a raw string.
  type: keyword
host.type:
  dashed_name: host-type
  description: 'Type of host.

    For Cloud providers this can be the machine type like `t2.medium`. If vm, this
    could be the container, for example, or other information meaningful in your environment.'
  flat_name: host.type
  ignore_above: 1024
  level: core
  name: type
  normalize: []
  short: Type of host.
  type: keyword
host.uptime:
  dashed_name: host-uptime
  description: Seconds the host has been up.
  example: 1325
  flat_name: host.uptime
  level: extended
  name: uptime
  normalize: []
  short: Seconds the host has been up.
  type: long
message:
  dashed_name: message
  description: 'For log events the message field contains the log message, optimized
    for viewing in a log viewer.

    For structured logs without an original message field, other fields can be concatenated
    to form a human-readable summary of the event.

    If multiple messages exist, they can be combined into one message.'
  example: Hello World
  flat_name: message
  level: core
  name: message
  normalize: []
  short: Log message optimized for viewing in a log viewer.
  type: match_only_text
package.name:
  dashed_name: package-name
  description: Package name
  example: go
  flat_name: package.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  short: Package name
  type: keyword
process.Ext:
  dashed_name: process-Ext
  description: Object for all custom defined fields to live in.
  flat_name: process.Ext
  level: custom
  name: Ext
  normalize: []
  short: Object for all custom defined fields to live in.
  type: object
process.Ext.ancestry:
  dashed_name: process-Ext-ancestry
  description: An array of entity_ids indicating the ancestors for this event
  flat_name: process.Ext.ancestry
  ignore_above: 1024
  level: custom
  name: Ext.ancestry
  normalize: []
  short: An array of entity_ids indicating the ancestors for this event
  type: keyword
process.Ext.architecture:
  dashed_name: process-Ext-architecture
  description: Process architecture.  It can differ from host architecture.
  example: x86_64
  flat_name: process.Ext.architecture
  ignore_above: 1024
  level: custom
  name: Ext.architecture
  normalize: []
  short: Process architecture.  It can differ from host architecture.
  type: keyword
process.Ext.authentication_id:
  dashed_name: process-Ext-authentication-id
  description: Process authentication ID
  flat_name: process.Ext.authentication_id
  ignore_above: 1024
  level: custom
  name: Ext.authentication_id
  normalize: []
  short: Process authentication ID
  type: keyword
process.Ext.code_signature:
  dashed_name: process-Ext-code-signature
  description: Nested version of ECS code_signature fieldset.
  flat_name: process.Ext.code_signature
  level: custom
  name: Ext.code_signature
  normalize: []
  short: Nested version of ECS code_signature fieldset.
  type: nested
process.Ext.code_signature.exists:
  dashed_name: process-Ext-code-signature-exists
  description: Boolean to capture if a signature is present.
  example: 'true'
  flat_name: process.Ext.code_signature.exists
  level: custom
  name: Ext.code_signature.exists
  normalize: []
  short: Boolean to capture if a signature is present.
  type: boolean
process.Ext.code_signature.status:
  dashed_name: process-Ext-code-signature-status
  description: 'Additional information about the certificate status.

    This is useful for logging cryptographic errors with the certificate validity
    or trust status. Leave unpopulated if the validity or trust of the certificate
    was unchecked.'
  example: ERROR_UNTRUSTED_ROOT
  flat_name: process.Ext.code_signature.status
  ignore_above: 1024
  level: custom
  name: Ext.code_signature.status
  normalize: []
  short: Additional information about the certificate status.
  type: keyword
process.Ext.code_signature.subject_name:
  dashed_name: process-Ext-code-signature-subject-name
  description: Subject name of the code signer
  example: Microsoft Corporation
  flat_name: process.Ext.code_signature.subject_name
  ignore_above: 1024
  level: custom
  name: Ext.code_signature.subject_name
  normalize: []
  short: Subject name of the code signer
  type: keyword
process.Ext.code_signature.trusted:
  dashed_name: process-Ext-code-signature-trusted
  description: 'Stores the trust status of the certificate chain.

    Validating the trust of the certificate chain may be complicated, and this field
    should only be populated by tools that actively check the status.'
  example: 'true'
  flat_name: process.Ext.code_signature.trusted
  level: custom
  name: Ext.code_signature.trusted
  normalize: []
  short: Stores the trust status of the certificate chain.
  type: boolean
process.Ext.code_signature.valid:
  dashed_name: process-Ext-code-signature-valid
  description: 'Boolean to capture if the digital signature is verified against the
    binary content.

    Leave unpopulated if a certificate was unchecked.'
  example: 'true'
  flat_name: process.Ext.code_signature.valid
  level: custom
  name: Ext.code_signature.valid
  normalize: []
  short: Boolean to capture if the digital signature is verified against the binary
    content.
  type: boolean
process.Ext.created_suspended:
  dashed_name: process-Ext-created-suspended
  description: A heuristic indicating if the CREATE_SUSPENDED flag was passed to the
    Win32 CreateProcess API. Not valid for direct syscalls.
  example: 'true'
  flat_name: process.Ext.created_suspended
  level: custom
  name: Ext.created_suspended
  normalize: []
  short: A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32
    CreateProcess API.
  type: boolean
process.Ext.defense_evasions:
  dashed_name: process-Ext-defense-evasions
  description: List of defense evasions found in this process. These defense evasions
    can make it harder to inspect a process and/or cause abnormal OS behavior. Examples
    tools that can cause defense evasions include Process Doppelganging and Process
    Herpaderping.
  flat_name: process.Ext.defense_evasions
  ignore_above: 1024
  level: custom
  name: Ext.defense_evasions
  normalize: []
  short: List of defense evasions found in this process.
  type: keyword
process.Ext.device.bus_type:
  dashed_name: process-Ext-device-bus-type
  description: Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.
  flat_name: process.Ext.device.bus_type
  ignore_above: 1024
  level: custom
  name: Ext.device.bus_type
  normalize: []
  short: Bus type of the device.
  type: keyword
process.Ext.device.dos_name:
  dashed_name: process-Ext-device-dos-name
  description: DOS name of the device. DOS device name is in the format of driver
    letters such as C:, D:,...
  flat_name: process.Ext.device.dos_name
  ignore_above: 1024
  level: custom
  name: Ext.device.dos_name
  normalize: []
  short: DOS name of the device.
  type: keyword
process.Ext.device.file_system_type:
  dashed_name: process-Ext-device-file-system-type
  description: 'Volume device file system type.

    Following are examples of the most frequently seen volume device file system types:
    NTFS UDF'
  flat_name: process.Ext.device.file_system_type
  ignore_above: 1024
  level: custom
  name: Ext.device.file_system_type
  normalize: []
  short: Volume device file system type.
  type: keyword
process.Ext.device.nt_name:
  dashed_name: process-Ext-device-nt-name
  description: 'NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2'
  flat_name: process.Ext.device.nt_name
  ignore_above: 1024
  level: custom
  name: Ext.device.nt_name
  normalize: []
  short: NT name of the device.
  type: keyword
process.Ext.device.product_id:
  dashed_name: process-Ext-device-product-id
  description: ProductID of the device. It is provided by the vendor of the device
    if any.
  flat_name: process.Ext.device.product_id
  ignore_above: 1024
  level: custom
  name: Ext.device.product_id
  normalize: []
  short: ProductID of the device.
  type: keyword
process.Ext.device.serial_number:
  dashed_name: process-Ext-device-serial-number
  description: Serial Number of the device. It is provided by the vendor of the device
    if any.
  flat_name: process.Ext.device.serial_number
  ignore_above: 1024
  level: custom
  name: Ext.device.serial_number
  normalize: []
  short: Serial Number of the device.
  type: keyword
process.Ext.device.vendor_id:
  dashed_name: process-Ext-device-vendor-id
  description: VendorID of the device. It is provided by the vendor of the device.
  flat_name: process.Ext.device.vendor_id
  ignore_above: 1024
  level: custom
  name: Ext.device.vendor_id
  normalize: []
  short: VendorID of the device.
  type: keyword
process.Ext.device.volume_device_type:
  dashed_name: process-Ext-device-volume-device-type
  description: 'Volume device type.

    Following are examples of the most frequently seen volume device types: Disk File
    System CD-ROM File System'
  flat_name: process.Ext.device.volume_device_type
  ignore_above: 1024
  level: custom
  name: Ext.device.volume_device_type
  normalize: []
  short: Volume device type.
  type: keyword
process.Ext.dll.Ext:
  dashed_name: process-Ext-dll-Ext
  description: Object for all custom defined fields to live in.
  flat_name: process.Ext.dll.Ext
  level: custom
  name: Ext
  normalize: []
  original_fieldset: dll
  short: Object for all custom defined fields to live in.
  type: object
process.Ext.dll.Ext.mapped_address:
  dashed_name: process-Ext-dll-Ext-mapped-address
  description: The base address where this module is loaded.
  flat_name: process.Ext.dll.Ext.mapped_address
  level: custom
  name: Ext.mapped_address
  normalize: []
  original_fieldset: dll
  short: The base address where this module is loaded.
  type: unsigned_long
process.Ext.dll.Ext.mapped_size:
  dashed_name: process-Ext-dll-Ext-mapped-size
  description: The size of this module's memory mapping, in bytes.
  flat_name: process.Ext.dll.Ext.mapped_size
  level: custom
  name: Ext.mapped_size
  normalize: []
  original_fieldset: dll
  short: The size of this module's memory mapping, in bytes.
  type: unsigned_long
process.Ext.dll.name:
  dashed_name: process-Ext-dll-name
  description: 'Name of the library.

    This generally maps to the name of the file on disk.'
  example: kernel32.dll
  flat_name: process.Ext.dll.name
  ignore_above: 1024
  level: core
  name: name
  normalize: []
  original_fieldset: dll
  short: Name of the library.
  type: keyword
process.Ext.dll.path:
  dashed_name: process-Ext-dll-path
  description: Full file path of the library.
  example: C:\Windows\System32\kernel32.dll
  flat_name: process.Ext.dll.path
  ignore_above: 1024
  level: extended
  name: path
  normalize: []
  original_fieldset: dll
  short: Full file path of the library.
  type: keyword
process.Ext.effective_parent.entity_id:
  dashed_name: process-Ext-effective-parent-entity-id
  description: Unique identifier for the effective process.
  example: c2c455d9f99375d
  flat_name: process.Ext.effective_parent.entity_id
  ignore_above: 1024
  level: custom
  name: entity_id
  normalize: []
  original_fieldset: Effective_process
  short: Unique identifier for the effective process.
  type: keyword
process.Ext.effective_parent.executable:
  dashed_name: process-Ext-effective-parent-executable
  description: Executable name for the effective process.
  example: C:\Windows\System32\wbem\WMIC.exe
  flat_name: process.Ext.effective_parent.executable
  ignore_above: 1024
  level: custom
  name: executable
  normalize: []
  original_fieldset: Effective_process
  short: Executable name for the effective process.
  type: keyword
process.Ext.effective_parent.name:
  dashed_name: process-Ext-effective-parent-name
  description: Process name for the effective process.
  example: WMIC.exe
  flat_name: process.Ext.effective_parent.name
  ignore_above: 1024
  level: custom
  name: name
  normalize: []
  original_fieldset: Effective_process
  short: Process name for the effective process.
  type: keyword
process.Ext.effective_parent.pid:
  dashed_name: process-Ext-effective-parent-pid
  description: Process ID.
  example: 4242
  flat_name: process.Ext.effective_parent.pid
  level: custom
  name: pid
  normalize: []
  original_fieldset: Effective_process
  short: Process ID.
  type: long
process.Ext.memfd:
  dashed_name: process-Ext-memfd
  description: Object for memfd events.
  flat_name: process.Ext.memfd
  level: custom
  name: Ext.memfd
  normalize: []
  short: Object for memfd events.
  type: object
process.Ext.memfd.flag_allow_seal:
  dashed_name: process-Ext-memfd-flag-allow-seal
  description: Allow sealing operations on this file.
  example: 'false'
  flat_name: process.Ext.memfd.flag_allow_seal
  level: custom
  name: Ext.memfd.flag_allow_seal
  normalize: []
  short: Allow sealing operations on this file.
  type: boolean
process.Ext.memfd.flag_cloexec:
  dashed_name: process-Ext-memfd-flag-cloexec
  description: Sets the the close-on-exec flag on the new file descriptor.
  example: 'false'
  flat_name: process.Ext.memfd.flag_cloexec
  level: custom
  name: Ext.memfd.flag_cloexec
  normalize: []
  short: Sets the the close-on-exec flag on the new file descriptor.
  type: boolean
process.Ext.memfd.flag_exec:
  dashed_name: process-Ext-memfd-flag-exec
  description: Exec flag is set for file.
  example: 'false'
  flat_name: process.Ext.memfd.flag_exec
  level: custom
  name: Ext.memfd.flag_exec
  normalize: []
  short: Exec flag is set for file.
  type: boolean
process.Ext.memfd.flag_hugetlb:
  dashed_name: process-Ext-memfd-flag-hugetlb
  description: The anonymous file will be created in the hugetlbfs filesystem using
    huge pages.
  example: 'false'
  flat_name: process.Ext.memfd.flag_hugetlb
  level: custom
  name: Ext.memfd.flag_hugetlb
  normalize: []
  short: The anonymous file will be created in the hugetlbfs filesystem using huge
    pages.
  type: boolean
process.Ext.memfd.flag_noexec_seal:
  dashed_name: process-Ext-memfd-flag-noexec-seal
  description: Sets both NOEXEC and MFD_ALLOW_SEALING.
  example: 'false'
  flat_name: process.Ext.memfd.flag_noexec_seal
  level: custom
  name: Ext.memfd.flag_noexec_seal
  normalize: []
  short: Sets both NOEXEC and MFD_ALLOW_SEALING.
  type: boolean
process.Ext.memfd.flags:
  dashed_name: process-Ext-memfd-flags
  description: Flags passed to the memfd operation.
  example: '2'
  flat_name: process.Ext.memfd.flags
  level: custom
  name: Ext.memfd.flags
  normalize: []
  short: Flags passed to the memfd operation.
  type: long
process.Ext.memfd.name:
  dashed_name: process-Ext-memfd-name
  description: Filename for the created file. Appears in /proc/self/fd.
  example: anon.txt
  flat_name: process.Ext.memfd.name
  ignore_above: 1024
  level: custom
  name: Ext.memfd.name
  normalize: []
  short: Filename for the created file. Appears in /proc/self/fd.
  type: keyword
process.Ext.mitigation_policies:
  dashed_name: process-Ext-mitigation-policies
  description: Process mitigation policies include SignaturePolicy, DynamicCodePolicy,
    UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft
    only, CF Guard, User Shadow Stack enabled
  flat_name: process.Ext.mitigation_policies
  ignore_above: 1024
  level: custom
  name: Ext.mitigation_policies
  normalize: []
  short: Process mitigation policies.
  type: keyword
process.Ext.protection:
  dashed_name: process-Ext-protection
  description: Indicates the protection level of this process.  Uses the same syntax
    as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light,
    and PsProtectedSignerWindows-Light.
  flat_name: process.Ext.protection
  ignore_above: 1024
  level: custom
  name: Ext.protection
  normalize: []
  short: OS-level protections granted to this process
  type: keyword
process.Ext.ptrace:
  dashed_name: process-Ext-ptrace
  description: Object for ptrace events.
  flat_name: process.Ext.ptrace
  level: custom
  name: Ext.ptrace
  normalize: []
  short: Object for ptrace events.
  type: object
process.Ext.ptrace.child_pid:
  dashed_name: process-Ext-ptrace-child-pid
  description: PID of the ptrace target.
  flat_name: process.Ext.ptrace.child_pid
  level: custom
  name: Ext.ptrace.child_pid
  normalize: []
  short: PID of the ptrace target.
  type: long
process.Ext.ptrace.request:
  dashed_name: process-Ext-ptrace-request
  description: ptrace request.
  flat_name: process.Ext.ptrace.request
  level: custom
  name: Ext.ptrace.request
  normalize: []
  short: ptrace request.
  type: long
process.Ext.relative_file_creation_time:
  dashed_name: process-Ext-relative-file-creation-time
  description: Number of seconds since the process's file was created. This number
    may be negative if the file's timestamp is in the future.
  flat_name: process.Ext.relative_file_creation_time
  level: custom
  name: Ext.relative_file_creation_time
  normalize: []
  short: Number of seconds since the process's file was created
  type: double
process.Ext.relative_file_name_modify_time:
  dashed_name: process-Ext-relative-file-name-modify-time
  description: Number of seconds since the process's name was modified. This information
    can come from the NTFS MFT. This number may be negative if the file's timestamp
    is in the future.
  flat_name: process.Ext.relative_file_name_modify_time
  level: custom
  name: Ext.relative_file_name_modify_time
  normalize: []
  short: Number of seconds since the process's name was modified
  type: double
process.Ext.session:
  dashed_name: process-Ext-session
  description: Session information for the current process
  flat_name: process.Ext.session
  ignore_above: 1024
  level: custom
  name: Ext.session
  normalize: []
  short: Session information for the current process
  type: keyword
process.Ext.session_info.authentication_package:
  dashed_name: process-Ext-session-info-authentication-package
  description: Name of authentication package used to log on, such as NTLM, Kerberos,
    or CloudAP
  flat_name: process.Ext.session_info.authentication_package
  ignore_above: 1024
  level: custom
  name: Ext.session_info.authentication_package
  normalize: []
  short: Name of authentication package used to log on, such as NTLM, Kerberos, or
    CloudAP
  type: keyword
process.Ext.session_info.client_address:
  dashed_name: process-Ext-session-info-client-address
  description: Client's IPv4 or IPv6 address as a string, if available.
  flat_name: process.Ext.session_info.client_address
  ignore_above: 1024
  level: custom
  name: Ext.session_info.client_address
  normalize: []
  short: Client's IPv4 or IPv6 address as a string, if available.
  type: keyword
process.Ext.session_info.id:
  dashed_name: process-Ext-session-info-id
  description: Session ID
  flat_name: process.Ext.session_info.id
  level: custom
  name: Ext.session_info.id
  normalize: []
  short: Session ID
  type: unsigned_long
process.Ext.session_info.logon_type:
  dashed_name: process-Ext-session-info-logon-type
  description: Session logon type.  Examples include Interactive, Network, and Service.
  flat_name: process.Ext.session_info.logon_type
  ignore_above: 1024
  level: custom
  name: Ext.session_info.logon_type
  normalize: []
  short: Session logon type.  Examples include Interactive, Network, and Service.
  type: keyword
process.Ext.session_info.relative_logon_time:
  dashed_name: process-Ext-session-info-relative-logon-time
  description: Process creation time, relative to logon time, in seconds.
  flat_name: process.Ext.session_info.relative_logon_time
  level: custom
  name: Ext.session_info.relative_logon_time
  normalize: []
  short: Process creation time, relative to logon time, in seconds.
  type: double
process.Ext.session_info.relative_password_age:
  dashed_name: process-Ext-session-info-relative-password-age
  description: Process creation time, relative to the last time the password was changed,
    in seconds.
  flat_name: process.Ext.session_info.relative_password_age
  level: custom
  name: Ext.session_info.relative_password_age
  normalize: []
  short: Process creation time, relative to the last time the password was changed,
    in seconds.
  type: double
process.Ext.session_info.user_flags:
  dashed_name: process-Ext-session-info-user-flags
  description: List of user flags associated with this logon session. Examples include
    LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.
  flat_name: process.Ext.session_info.user_flags
  ignore_above: 1024
  level: custom
  name: Ext.session_info.user_flags
  normalize: []
  short: List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED
    and LOGON_WINLOGON.
  type: keyword
process.Ext.shmget:
  dashed_name: process-Ext-shmget
  description: Object for shmget events.
  flat_name: process.Ext.shmget
  level: custom
  name: Ext.shmget
  normalize: []
  short: Object for shmget events.
  type: object
process.Ext.shmget.flags:
  dashed_name: process-Ext-shmget-flags
  description: flags passed to shmget.
  flat_name: process.Ext.shmget.flags
  level: custom
  name: Ext.shmget.flags
  normalize: []
  short: flags passed to shmget.
  type: long
process.Ext.shmget.key:
  dashed_name: process-Ext-shmget-key
  description: Key passed to the shmget request.
  flat_name: process.Ext.shmget.key
  level: custom
  name: Ext.shmget.key
  normalize: []
  short: Key passed to the shmget request.
  type: long
process.Ext.shmget.size:
  dashed_name: process-Ext-shmget-size
  description: Requested size.
  flat_name: process.Ext.shmget.size
  level: custom
  name: Ext.shmget.size
  normalize: []
  short: Requested size.
  type: long
process.Ext.token.elevation:
  dashed_name: process-Ext-token-elevation
  description: Whether the token is elevated or not
  flat_name: process.Ext.token.elevation
  level: custom
  name: elevation
  normalize: []
  original_fieldset: token
  short: Whether the token is elevated or not
  type: boolean
process.Ext.token.elevation_level:
  dashed_name: process-Ext-token-elevation-level
  description: What level of elevation the token has
  example: one of "default", "full", "limited"
  flat_name: process.Ext.token.elevation_level
  ignore_above: 1024
  level: custom
  name: elevation_level
  normalize: []
  original_fieldset: token
  short: What level of elevation the token has
  type: keyword
process.Ext.token.elevation_type:
  dashed_name: process-Ext-token-elevation-type
  description: What level of elevation the token has
  example: one of "default", "full", "limited"
  flat_name: process.Ext.token.elevation_type
  ignore_above: 1024
  level: custom
  name: elevation_type
  normalize: []
  original_fieldset: token
  short: What level of elevation the token has
  type: keyword
process.Ext.token.integrity_level_name:
  dashed_name: process-Ext-token-integrity-level-name
  description: Human readable integrity level.
  example: one of "system", "high", "medium", "low", "untrusted"
  flat_name: process.Ext.token.integrity_level_name
  ignore_above: 1024
  level: custom
  name: integrity_level_name
  normalize: []
  original_fieldset: token
  short: Human readable integrity level.
  type: keyword
process.Ext.token.security_attributes:
  dashed_name: process-Ext-token-security-attributes
  description: Array of security attributes of the token, retrieved via the  TokenSecurityAttributes
    class.
  example: TSA://ProcUnique, LUA://DecHdAutoAp
  flat_name: process.Ext.token.security_attributes
  ignore_above: 1024
  level: custom
  name: security_attributes
  normalize: []
  original_fieldset: token
  short: Array of security attributes of the token, retrieved via the  TokenSecurityAttributes
    class.
  type: keyword
process.Ext.trusted:
  dashed_name: process-Ext-trusted
  description: Whether or not the process is a trusted application
  flat_name: process.Ext.trusted
  level: custom
  name: Ext.trusted
  normalize: []
  short: Whether or not the process is a trusted application
  type: boolean
process.Ext.trusted_descendant:
  dashed_name: process-Ext-trusted-descendant
  description: Whether or not the process is a descendent of a trusted application
  flat_name: process.Ext.trusted_descendant
  level: custom
  name: Ext.trusted_descendant
  normalize: []
  short: Whether or not the process is a descendent of a trusted application
  type: boolean
process.Ext.windows:
  dashed_name: process-Ext-windows
  description: Platform-specific Windows fields
  flat_name: process.Ext.windows
  level: custom
  name: Ext.windows
  normalize: []
  short: Platform-specific Windows fields
  type: object
process.Ext.windows.zone_identifier:
  dashed_name: process-Ext-windows-zone-identifier
  description: Windows zone identifier for a process's executable file
  example: 3
  flat_name: process.Ext.windows.zone_identifier
  ignore_above: 1024
  level: custom
  name: Ext.windows.zone_identifier
  normalize: []
  short: Windows zone identifier for a process's executable file
  type: keyword
process.args:
  dashed_name: process-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  short: Array of process arguments.
  type: keyword
process.args_count:
  dashed_name: process-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.args_count
  level: extended
  name: args_count
  normalize: []
  short: Length of the process.args array.
  type: long
process.code_signature.exists:
  dashed_name: process-code-signature-exists
  description: Boolean to capture if a signature is present.
  example: 'true'
  flat_name: process.code_signature.exists
  level: core
  name: exists
  normalize: []
  original_fieldset: code_signature
  short: Boolean to capture if a signature is present.
  type: boolean
process.code_signature.signing_id:
  dashed_name: process-code-signature-signing-id
  description: 'The identifier used to sign the process.

    This is used to identify the application manufactured by a software vendor. The
    field is relevant to Apple *OS only.'
  example: com.apple.xpc.proxy
  flat_name: process.code_signature.signing_id
  ignore_above: 1024
  level: extended
  name: signing_id
  normalize: []
  original_fieldset: code_signature
  short: The identifier used to sign the process.
  type: keyword
process.code_signature.status:
  dashed_name: process-code-signature-status
  description: 'Additional information about the certificate status.

    This is useful for logging cryptographic errors with the certificate validity
    or trust status. Leave unpopulated if the validity or trust of the certificate
    was unchecked.'
  example: ERROR_UNTRUSTED_ROOT
  flat_name: process.code_signature.status
  ignore_above: 1024
  level: extended
  name: status
  normalize: []
  original_fieldset: code_signature
  short: Additional information about the certificate status.
  type: keyword
process.code_signature.subject_name:
  dashed_name: process-code-signature-subject-name
  description: Subject name of the code signer
  example: Microsoft Corporation
  flat_name: process.code_signature.subject_name
  ignore_above: 1024
  level: core
  name: subject_name
  normalize: []
  original_fieldset: code_signature
  short: Subject name of the code signer
  type: keyword
process.code_signature.team_id:
  dashed_name: process-code-signature-team-id
  description: 'The team identifier used to sign the process.

    This is used to identify the team or vendor of a software product. The field is
    relevant to Apple *OS only.'
  example: EQHXZ8M8AV
  flat_name: process.code_signature.team_id
  ignore_above: 1024
  level: extended
  name: team_id
  normalize: []
  original_fieldset: code_signature
  short: The team identifier used to sign the process.
  type: keyword
process.code_signature.trusted:
  dashed_name: process-code-signature-trusted
  description: 'Stores the trust status of the certificate chain.

    Validating the trust of the certificate chain may be complicated, and this field
    should only be populated by tools that actively check the status.'
  example: 'true'
  flat_name: process.code_signature.trusted
  level: extended
  name: trusted
  normalize: []
  original_fieldset: code_signature
  short: Stores the trust status of the certificate chain.
  type: boolean
process.code_signature.valid:
  dashed_name: process-code-signature-valid
  description: 'Boolean to capture if the digital signature is verified against the
    binary content.

    Leave unpopulated if a certificate was unchecked.'
  example: 'true'
  flat_name: process.code_signature.valid
  level: extended
  name: valid
  normalize: []
  original_fieldset: code_signature
  short: Boolean to capture if the digital signature is verified against the binary
    content.
  type: boolean
process.command_line:
  dashed_name: process-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.command_line
  level: extended
  multi_fields:
  - flat_name: process.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  short: Full command line that started the process.
  type: wildcard
process.end:
  dashed_name: process-end
  description: The time the process ended.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.end
  level: extended
  name: end
  normalize: []
  short: The time the process ended.
  type: date
process.entity_id:
  dashed_name: process-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  short: Unique identifier for the process.
  type: keyword
process.executable:
  dashed_name: process-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  short: Absolute path to the process executable.
  type: keyword
process.exit_code:
  dashed_name: process-exit-code
  description: 'The exit code of the process, if this is a termination event.

    The field should be absent if there is no exit code for the event (e.g. process
    start).'
  example: 137
  flat_name: process.exit_code
  level: extended
  name: exit_code
  normalize: []
  short: The exit code of the process.
  type: long
process.group.id:
  dashed_name: process-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.group.name:
  dashed_name: process-group-name
  description: Name of the group.
  flat_name: process.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.hash.md5:
  dashed_name: process-hash-md5
  description: MD5 hash.
  flat_name: process.hash.md5
  ignore_above: 1024
  level: extended
  name: md5
  normalize: []
  original_fieldset: hash
  short: MD5 hash.
  type: keyword
process.hash.sha1:
  dashed_name: process-hash-sha1
  description: SHA1 hash.
  flat_name: process.hash.sha1
  ignore_above: 1024
  level: extended
  name: sha1
  normalize: []
  original_fieldset: hash
  short: SHA1 hash.
  type: keyword
process.hash.sha256:
  dashed_name: process-hash-sha256
  description: SHA256 hash.
  flat_name: process.hash.sha256
  ignore_above: 1024
  level: extended
  name: sha256
  normalize: []
  original_fieldset: hash
  short: SHA256 hash.
  type: keyword
process.hash.sha512:
  dashed_name: process-hash-sha512
  description: SHA512 hash.
  flat_name: process.hash.sha512
  ignore_above: 1024
  level: extended
  name: sha512
  normalize: []
  original_fieldset: hash
  short: SHA512 hash.
  type: keyword
process.name:
  dashed_name: process-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  short: Process name.
  type: keyword
process.origin_referrer_url:
  dashed_name: process-origin-referrer-url
  description: The URL of the webpage that linked to the process's executable file.
  example: http://example.com/article1.html
  flat_name: process.origin_referrer_url
  ignore_above: 8192
  level: extended
  name: origin_referrer_url
  normalize: []
  short: The URL of the webpage that linked to the process's executable file.
  type: keyword
process.origin_url:
  dashed_name: process-origin-url
  description: The URL where the process's executable file is hosted.
  example: http://example.com/files/example.exe
  flat_name: process.origin_url
  ignore_above: 8192
  level: extended
  name: origin_url
  normalize: []
  short: The URL where the process's executable file is hosted.
  type: keyword
process.parent.Ext:
  dashed_name: process-parent-Ext
  description: Object for all custom defined fields to live in.
  flat_name: process.parent.Ext
  level: custom
  name: Ext
  normalize: []
  original_fieldset: process
  short: Object for all custom defined fields to live in.
  type: object
process.parent.Ext.architecture:
  dashed_name: process-parent-Ext-architecture
  description: Process architecture.  It can differ from host architecture.
  example: x86_64
  flat_name: process.parent.Ext.architecture
  ignore_above: 1024
  level: custom
  name: Ext.architecture
  normalize: []
  original_fieldset: process
  short: Process architecture.  It can differ from host architecture.
  type: keyword
process.parent.Ext.code_signature:
  dashed_name: process-parent-Ext-code-signature
  description: Nested version of ECS code_signature fieldset.
  flat_name: process.parent.Ext.code_signature
  level: custom
  name: Ext.code_signature
  normalize: []
  original_fieldset: process
  short: Nested version of ECS code_signature fieldset.
  type: nested
process.parent.Ext.code_signature.exists:
  dashed_name: process-parent-Ext-code-signature-exists
  description: Boolean to capture if a signature is present.
  example: 'true'
  flat_name: process.parent.Ext.code_signature.exists
  level: custom
  name: Ext.code_signature.exists
  normalize: []
  original_fieldset: process
  short: Boolean to capture if a signature is present.
  type: boolean
process.parent.Ext.code_signature.status:
  dashed_name: process-parent-Ext-code-signature-status
  description: 'Additional information about the certificate status.

    This is useful for logging cryptographic errors with the certificate validity
    or trust status. Leave unpopulated if the validity or trust of the certificate
    was unchecked.'
  example: ERROR_UNTRUSTED_ROOT
  flat_name: process.parent.Ext.code_signature.status
  ignore_above: 1024
  level: custom
  name: Ext.code_signature.status
  normalize: []
  original_fieldset: process
  short: Additional information about the certificate status.
  type: keyword
process.parent.Ext.code_signature.subject_name:
  dashed_name: process-parent-Ext-code-signature-subject-name
  description: Subject name of the code signer
  example: Microsoft Corporation
  flat_name: process.parent.Ext.code_signature.subject_name
  ignore_above: 1024
  level: custom
  name: Ext.code_signature.subject_name
  normalize: []
  original_fieldset: process
  short: Subject name of the code signer
  type: keyword
process.parent.Ext.code_signature.trusted:
  dashed_name: process-parent-Ext-code-signature-trusted
  description: 'Stores the trust status of the certificate chain.

    Validating the trust of the certificate chain may be complicated, and this field
    should only be populated by tools that actively check the status.'
  example: 'true'
  flat_name: process.parent.Ext.code_signature.trusted
  level: custom
  name: Ext.code_signature.trusted
  normalize: []
  original_fieldset: process
  short: Stores the trust status of the certificate chain.
  type: boolean
process.parent.Ext.code_signature.valid:
  dashed_name: process-parent-Ext-code-signature-valid
  description: 'Boolean to capture if the digital signature is verified against the
    binary content.

    Leave unpopulated if a certificate was unchecked.'
  example: 'true'
  flat_name: process.parent.Ext.code_signature.valid
  level: custom
  name: Ext.code_signature.valid
  normalize: []
  original_fieldset: process
  short: Boolean to capture if the digital signature is verified against the binary
    content.
  type: boolean
process.parent.Ext.protection:
  dashed_name: process-parent-Ext-protection
  description: Indicates the protection level of this process.  Uses the same syntax
    as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light,
    and PsProtectedSignerWindows-Light.
  flat_name: process.parent.Ext.protection
  ignore_above: 1024
  level: custom
  name: Ext.protection
  normalize: []
  original_fieldset: process
  short: OS-level protections granted to this process
  type: keyword
process.parent.Ext.real:
  dashed_name: process-parent-Ext-real
  description: The field set containing process info in case of any pid spoofing.
    This is mainly useful for process.parent.
  flat_name: process.parent.Ext.real
  level: custom
  name: Ext.real
  normalize: []
  original_fieldset: process
  short: The field set containing process info in case of any pid spoofing. This is
    mainly useful for process.parent.
  type: object
process.parent.Ext.real.pid:
  dashed_name: process-parent-Ext-real-pid
  description: For process.parent this will be the ppid of the process that actually
    spawned the current process.
  flat_name: process.parent.Ext.real.pid
  level: custom
  name: Ext.real.pid
  normalize: []
  original_fieldset: process
  short: The real pid of the process if ppid spoofing is happening.
  type: long
process.parent.Ext.user:
  dashed_name: process-parent-Ext-user
  description: User associated with the running process.
  flat_name: process.parent.Ext.user
  ignore_above: 1024
  level: custom
  name: Ext.user
  normalize: []
  original_fieldset: process
  short: User associated with the running process.
  type: keyword
process.parent.args:
  dashed_name: process-parent-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.parent.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.parent.args_count:
  dashed_name: process-parent-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.parent.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.parent.code_signature.exists:
  dashed_name: process-parent-code-signature-exists
  description: Boolean to capture if a signature is present.
  example: 'true'
  flat_name: process.parent.code_signature.exists
  level: core
  name: exists
  normalize: []
  original_fieldset: code_signature
  short: Boolean to capture if a signature is present.
  type: boolean
process.parent.code_signature.signing_id:
  dashed_name: process-parent-code-signature-signing-id
  description: 'The identifier used to sign the process.

    This is used to identify the application manufactured by a software vendor. The
    field is relevant to Apple *OS only.'
  example: com.apple.xpc.proxy
  flat_name: process.parent.code_signature.signing_id
  ignore_above: 1024
  level: extended
  name: signing_id
  normalize: []
  original_fieldset: code_signature
  short: The identifier used to sign the process.
  type: keyword
process.parent.code_signature.status:
  dashed_name: process-parent-code-signature-status
  description: 'Additional information about the certificate status.

    This is useful for logging cryptographic errors with the certificate validity
    or trust status. Leave unpopulated if the validity or trust of the certificate
    was unchecked.'
  example: ERROR_UNTRUSTED_ROOT
  flat_name: process.parent.code_signature.status
  ignore_above: 1024
  level: extended
  name: status
  normalize: []
  original_fieldset: code_signature
  short: Additional information about the certificate status.
  type: keyword
process.parent.code_signature.subject_name:
  dashed_name: process-parent-code-signature-subject-name
  description: Subject name of the code signer
  example: Microsoft Corporation
  flat_name: process.parent.code_signature.subject_name
  ignore_above: 1024
  level: core
  name: subject_name
  normalize: []
  original_fieldset: code_signature
  short: Subject name of the code signer
  type: keyword
process.parent.code_signature.team_id:
  dashed_name: process-parent-code-signature-team-id
  description: 'The team identifier used to sign the process.

    This is used to identify the team or vendor of a software product. The field is
    relevant to Apple *OS only.'
  example: EQHXZ8M8AV
  flat_name: process.parent.code_signature.team_id
  ignore_above: 1024
  level: extended
  name: team_id
  normalize: []
  original_fieldset: code_signature
  short: The team identifier used to sign the process.
  type: keyword
process.parent.code_signature.trusted:
  dashed_name: process-parent-code-signature-trusted
  description: 'Stores the trust status of the certificate chain.

    Validating the trust of the certificate chain may be complicated, and this field
    should only be populated by tools that actively check the status.'
  example: 'true'
  flat_name: process.parent.code_signature.trusted
  level: extended
  name: trusted
  normalize: []
  original_fieldset: code_signature
  short: Stores the trust status of the certificate chain.
  type: boolean
process.parent.code_signature.valid:
  dashed_name: process-parent-code-signature-valid
  description: 'Boolean to capture if the digital signature is verified against the
    binary content.

    Leave unpopulated if a certificate was unchecked.'
  example: 'true'
  flat_name: process.parent.code_signature.valid
  level: extended
  name: valid
  normalize: []
  original_fieldset: code_signature
  short: Boolean to capture if the digital signature is verified against the binary
    content.
  type: boolean
process.parent.command_line:
  dashed_name: process-parent-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.parent.command_line
  level: extended
  multi_fields:
  - flat_name: process.parent.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  original_fieldset: process
  short: Full command line that started the process.
  type: wildcard
process.parent.entity_id:
  dashed_name: process-parent-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.parent.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.parent.executable:
  dashed_name: process-parent-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.parent.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.parent.exit_code:
  dashed_name: process-parent-exit-code
  description: 'The exit code of the process, if this is a termination event.

    The field should be absent if there is no exit code for the event (e.g. process
    start).'
  example: 137
  flat_name: process.parent.exit_code
  level: extended
  name: exit_code
  normalize: []
  original_fieldset: process
  short: The exit code of the process.
  type: long
process.parent.hash.md5:
  dashed_name: process-parent-hash-md5
  description: MD5 hash.
  flat_name: process.parent.hash.md5
  ignore_above: 1024
  level: extended
  name: md5
  normalize: []
  original_fieldset: hash
  short: MD5 hash.
  type: keyword
process.parent.hash.sha1:
  dashed_name: process-parent-hash-sha1
  description: SHA1 hash.
  flat_name: process.parent.hash.sha1
  ignore_above: 1024
  level: extended
  name: sha1
  normalize: []
  original_fieldset: hash
  short: SHA1 hash.
  type: keyword
process.parent.hash.sha256:
  dashed_name: process-parent-hash-sha256
  description: SHA256 hash.
  flat_name: process.parent.hash.sha256
  ignore_above: 1024
  level: extended
  name: sha256
  normalize: []
  original_fieldset: hash
  short: SHA256 hash.
  type: keyword
process.parent.hash.sha512:
  dashed_name: process-parent-hash-sha512
  description: SHA512 hash.
  flat_name: process.parent.hash.sha512
  ignore_above: 1024
  level: extended
  name: sha512
  normalize: []
  original_fieldset: hash
  short: SHA512 hash.
  type: keyword
process.parent.name:
  dashed_name: process-parent-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.parent.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: process
  short: Process name.
  type: keyword
process.parent.pe.company:
  dashed_name: process-parent-pe-company
  description: Internal company name of the file, provided at compile-time.
  example: Microsoft Corporation
  flat_name: process.parent.pe.company
  ignore_above: 1024
  level: extended
  name: company
  normalize: []
  original_fieldset: pe
  short: Internal company name of the file, provided at compile-time.
  type: keyword
process.parent.pe.description:
  dashed_name: process-parent-pe-description
  description: Internal description of the file, provided at compile-time.
  example: Paint
  flat_name: process.parent.pe.description
  ignore_above: 1024
  level: extended
  name: description
  normalize: []
  original_fieldset: pe
  short: Internal description of the file, provided at compile-time.
  type: keyword
process.parent.pe.file_version:
  dashed_name: process-parent-pe-file-version
  description: Internal version of the file, provided at compile-time.
  example: 6.3.9600.17415
  flat_name: process.parent.pe.file_version
  ignore_above: 1024
  level: extended
  name: file_version
  normalize: []
  original_fieldset: pe
  short: Process name.
  type: keyword
process.parent.pe.imphash:
  dashed_name: process-parent-pe-imphash
  description: 'A hash of the imports in a PE file. An imphash -- or import hash --
    can be used to fingerprint binaries even after recompilation or other code-level
    transformations have occurred, which would change more traditional hash values.

    Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
  example: 0c6803c4e922103c4dca5963aad36ddf
  flat_name: process.parent.pe.imphash
  ignore_above: 1024
  level: extended
  name: imphash
  normalize: []
  original_fieldset: pe
  short: A hash of the imports in a PE file.
  type: keyword
process.parent.pe.original_file_name:
  dashed_name: process-parent-pe-original-file-name
  description: Internal name of the file, provided at compile-time.
  example: MSPAINT.EXE
  flat_name: process.parent.pe.original_file_name
  ignore_above: 1024
  level: extended
  name: original_file_name
  normalize: []
  original_fieldset: pe
  short: Internal name of the file, provided at compile-time.
  type: keyword
process.parent.pe.product:
  dashed_name: process-parent-pe-product
  description: Internal product name of the file, provided at compile-time.
  example: "Microsoft\xAE Windows\xAE Operating System"
  flat_name: process.parent.pe.product
  ignore_above: 1024
  level: extended
  name: product
  normalize: []
  original_fieldset: pe
  short: Internal product name of the file, provided at compile-time.
  type: keyword
process.parent.pgid:
  dashed_name: process-parent-pgid
  description: 'Deprecated for removal in next major version release. This field is
    superseded by `process.group_leader.pid`.

    Identifier of the group of processes the process belongs to.'
  flat_name: process.parent.pgid
  format: string
  level: extended
  name: pgid
  normalize: []
  original_fieldset: process
  short: Deprecated identifier of the group of processes the process belongs to.
  type: long
process.parent.pid:
  dashed_name: process-parent-pid
  description: Process id.
  example: 4242
  flat_name: process.parent.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.parent.ppid:
  dashed_name: process-parent-ppid
  description: Parent process' pid.
  example: 4241
  flat_name: process.parent.ppid
  format: string
  level: extended
  name: ppid
  normalize: []
  original_fieldset: process
  short: Parent process' pid.
  type: long
process.parent.thread.Ext:
  dashed_name: process-parent-thread-Ext
  description: Object for all custom defined fields to live in.
  flat_name: process.parent.thread.Ext
  level: custom
  name: thread.Ext
  normalize: []
  original_fieldset: process
  short: Object for all custom defined fields to live in.
  type: object
process.parent.thread.Ext.call_stack:
  dashed_name: process-parent-thread-Ext-call-stack
  description: Fields describing a stack frame.  call_stack is expected to be an array
    where each array element represents a stack frame.
  enabled: true
  flat_name: process.parent.thread.Ext.call_stack
  level: custom
  name: call_stack
  normalize: []
  original_fieldset: call_stack
  short: Fields describing a stack frame.
  type: object
process.parent.thread.Ext.call_stack.allocation_private_bytes:
  dashed_name: process-parent-thread-Ext-call-stack-allocation-private-bytes
  description: The number of bytes in this memory allocation/image that are both +X
    and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.
  flat_name: process.parent.thread.Ext.call_stack.allocation_private_bytes
  level: custom
  name: allocation_private_bytes
  normalize: []
  original_fieldset: call_stack
  short: The number of bytes in this memory allocation/image that are both +X and
    non-shareable.
  type: unsigned_long
process.parent.thread.Ext.call_stack.callsite_leading_bytes:
  dashed_name: process-parent-thread-Ext-call-stack-callsite-leading-bytes
  description: Hex opcode bytes preceding the callsite
  flat_name: process.parent.thread.Ext.call_stack.callsite_leading_bytes
  ignore_above: 1024
  level: custom
  name: callsite_leading_bytes
  normalize: []
  original_fieldset: call_stack
  short: Hex opcode bytes preceding the callsite
  type: keyword
process.parent.thread.Ext.call_stack.callsite_trailing_bytes:
  dashed_name: process-parent-thread-Ext-call-stack-callsite-trailing-bytes
  description: Hex opcode bytes after the callsite (where control will return to)
  flat_name: process.parent.thread.Ext.call_stack.callsite_trailing_bytes
  ignore_above: 1024
  level: custom
  name: callsite_trailing_bytes
  normalize: []
  original_fieldset: call_stack
  short: Hex opcode bytes after the callsite (where control will return to)
  type: keyword
process.parent.thread.Ext.call_stack.protection:
  dashed_name: process-parent-thread-Ext-call-stack-protection
  description: Protection of the page containing this instruction.  This is `R-X'
    by default if omitted.
  flat_name: process.parent.thread.Ext.call_stack.protection
  ignore_above: 1024
  level: custom
  name: protection
  normalize: []
  original_fieldset: call_stack
  short: Protection of the page containing this instruction.  This is `R-X' by default
    if omitted.
  type: keyword
process.parent.thread.Ext.call_stack.symbol_info:
  dashed_name: process-parent-thread-Ext-call-stack-symbol-info
  description: The nearest symbol for `instruction_pointer`.
  flat_name: process.parent.thread.Ext.call_stack.symbol_info
  ignore_above: 1024
  level: custom
  name: symbol_info
  normalize: []
  original_fieldset: call_stack
  short: The nearest symbol for `instruction_pointer`.
  type: keyword
process.parent.thread.Ext.call_stack_contains_unbacked:
  dashed_name: process-parent-thread-Ext-call-stack-contains-unbacked
  description: Indicates whether the creating thread's stack contains frames pointing
    outside any known executable image.
  flat_name: process.parent.thread.Ext.call_stack_contains_unbacked
  level: custom
  name: thread.Ext.call_stack_contains_unbacked
  normalize: []
  original_fieldset: process
  short: Indicates whether the creating thread's stack contains frames pointing outside
    any known executable image.
  type: boolean
process.parent.thread.Ext.call_stack_summary:
  dashed_name: process-parent-thread-Ext-call-stack-summary
  description: Concatentation of the non-repeated modules in the call stack.
  example: ntdll.dll|example.exe|kernel32.dll|ntdll.dll
  flat_name: process.parent.thread.Ext.call_stack_summary
  ignore_above: 1024
  level: custom
  name: thread.Ext.call_stack_summary
  normalize: []
  original_fieldset: process
  short: Concatentation of the non-repeated modules in the call stack.
  type: keyword
process.parent.thread.Ext.hardware_breakpoint_set:
  dashed_name: process-parent-thread-Ext-hardware-breakpoint-set
  description: Whether a hardware breakpoint was set for the thread. This field is
    omitted if false.
  example: 'true'
  flat_name: process.parent.thread.Ext.hardware_breakpoint_set
  level: custom
  name: thread.Ext.hardware_breakpoint_set
  normalize: []
  original_fieldset: process
  short: Whether a hardware breakpoint was set for the thread.
  type: boolean
process.parent.thread.id:
  dashed_name: process-parent-thread-id
  description: Thread ID.
  example: 4242
  flat_name: process.parent.thread.id
  format: string
  level: extended
  name: thread.id
  normalize: []
  original_fieldset: process
  short: Thread ID.
  type: long
process.parent.thread.name:
  dashed_name: process-parent-thread-name
  description: Thread name.
  example: thread-0
  flat_name: process.parent.thread.name
  ignore_above: 1024
  level: extended
  name: thread.name
  normalize: []
  original_fieldset: process
  short: Thread name.
  type: keyword
process.parent.title:
  dashed_name: process-parent-title
  description: 'Process title.

    The proctitle, some times the same as process name. Can also be different: for
    example a browser setting its title to the web page currently opened.'
  flat_name: process.parent.title
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.title.text
    name: text
    type: match_only_text
  name: title
  normalize: []
  original_fieldset: process
  short: Process title.
  type: keyword
process.parent.uptime:
  dashed_name: process-parent-uptime
  description: Seconds the process has been up.
  example: 1325
  flat_name: process.parent.uptime
  level: extended
  name: uptime
  normalize: []
  original_fieldset: process
  short: Seconds the process has been up.
  type: long
process.parent.working_directory:
  dashed_name: process-parent-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.parent.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  original_fieldset: process
  short: The working directory of the process.
  type: keyword
process.pe.company:
  dashed_name: process-pe-company
  description: Internal company name of the file, provided at compile-time.
  example: Microsoft Corporation
  flat_name: process.pe.company
  ignore_above: 1024
  level: extended
  name: company
  normalize: []
  original_fieldset: pe
  short: Internal company name of the file, provided at compile-time.
  type: keyword
process.pe.description:
  dashed_name: process-pe-description
  description: Internal description of the file, provided at compile-time.
  example: Paint
  flat_name: process.pe.description
  ignore_above: 1024
  level: extended
  name: description
  normalize: []
  original_fieldset: pe
  short: Internal description of the file, provided at compile-time.
  type: keyword
process.pe.file_version:
  dashed_name: process-pe-file-version
  description: Internal version of the file, provided at compile-time.
  example: 6.3.9600.17415
  flat_name: process.pe.file_version
  ignore_above: 1024
  level: extended
  name: file_version
  normalize: []
  original_fieldset: pe
  short: Process name.
  type: keyword
process.pe.imphash:
  dashed_name: process-pe-imphash
  description: 'A hash of the imports in a PE file. An imphash -- or import hash --
    can be used to fingerprint binaries even after recompilation or other code-level
    transformations have occurred, which would change more traditional hash values.

    Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.'
  example: 0c6803c4e922103c4dca5963aad36ddf
  flat_name: process.pe.imphash
  ignore_above: 1024
  level: extended
  name: imphash
  normalize: []
  original_fieldset: pe
  short: A hash of the imports in a PE file.
  type: keyword
process.pe.original_file_name:
  dashed_name: process-pe-original-file-name
  description: Internal name of the file, provided at compile-time.
  example: MSPAINT.EXE
  flat_name: process.pe.original_file_name
  ignore_above: 1024
  level: extended
  name: original_file_name
  normalize: []
  original_fieldset: pe
  short: Internal name of the file, provided at compile-time.
  type: keyword
process.pe.product:
  dashed_name: process-pe-product
  description: Internal product name of the file, provided at compile-time.
  example: "Microsoft\xAE Windows\xAE Operating System"
  flat_name: process.pe.product
  ignore_above: 1024
  level: extended
  name: product
  normalize: []
  original_fieldset: pe
  short: Internal product name of the file, provided at compile-time.
  type: keyword
process.pgid:
  dashed_name: process-pgid
  description: 'Deprecated for removal in next major version release. This field is
    superseded by `process.group_leader.pid`.

    Identifier of the group of processes the process belongs to.'
  flat_name: process.pgid
  format: string
  level: extended
  name: pgid
  normalize: []
  short: Deprecated identifier of the group of processes the process belongs to.
  type: long
process.pid:
  dashed_name: process-pid
  description: Process id.
  example: 4242
  flat_name: process.pid
  format: string
  level: core
  name: pid
  normalize: []
  short: Process id.
  type: long
process.ppid:
  dashed_name: process-ppid
  description: Parent process' pid.
  example: 4241
  flat_name: process.ppid
  format: string
  level: extended
  name: ppid
  normalize: []
  short: Parent process' pid.
  type: long
process.thread.capabilities.effective:
  dashed_name: process-thread-capabilities-effective
  description: This is the set of capabilities used by the kernel to perform permission
    checks for the thread.
  example: '["CAP_BPF", "CAP_SYS_ADMIN"]'
  flat_name: process.thread.capabilities.effective
  ignore_above: 1024
  level: extended
  name: thread.capabilities.effective
  normalize:
  - array
  pattern: ^(CAP_[A-Z_]+|\d+)$
  short: Array of capabilities used for permission checks.
  type: keyword
process.thread.capabilities.permitted:
  dashed_name: process-thread-capabilities-permitted
  description: This is a limiting superset for the effective capabilities that the
    thread may assume.
  example: '["CAP_BPF", "CAP_SYS_ADMIN"]'
  flat_name: process.thread.capabilities.permitted
  ignore_above: 1024
  level: extended
  name: thread.capabilities.permitted
  normalize:
  - array
  pattern: ^(CAP_[A-Z_]+|\d+)$
  short: Array of capabilities a thread could assume.
  type: keyword
process.thread.id:
  dashed_name: process-thread-id
  description: Thread ID.
  example: 4242
  flat_name: process.thread.id
  format: string
  level: extended
  name: thread.id
  normalize: []
  short: Thread ID.
  type: long
process.thread.name:
  dashed_name: process-thread-name
  description: Thread name.
  example: thread-0
  flat_name: process.thread.name
  ignore_above: 1024
  level: extended
  name: thread.name
  normalize: []
  short: Thread name.
  type: keyword
process.title:
  dashed_name: process-title
  description: 'Process title.

    The proctitle, some times the same as process name. Can also be different: for
    example a browser setting its title to the web page currently opened.'
  flat_name: process.title
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.title.text
    name: text
    type: match_only_text
  name: title
  normalize: []
  short: Process title.
  type: keyword
process.uptime:
  dashed_name: process-uptime
  description: Seconds the process has been up.
  example: 1325
  flat_name: process.uptime
  level: extended
  name: uptime
  normalize: []
  short: Seconds the process has been up.
  type: long
process.working_directory:
  dashed_name: process-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  short: The working directory of the process.
  type: keyword
source.geo.city_name:
  dashed_name: source-geo-city-name
  description: City name.
  example: Montreal
  flat_name: source.geo.city_name
  ignore_above: 1024
  level: core
  name: city_name
  normalize: []
  original_fieldset: geo
  short: City name.
  type: keyword
source.geo.continent_code:
  dashed_name: source-geo-continent-code
  description: Two-letter code representing continent's name.
  example: NA
  flat_name: source.geo.continent_code
  ignore_above: 1024
  level: core
  name: continent_code
  normalize: []
  original_fieldset: geo
  short: Continent code.
  type: keyword
source.geo.continent_name:
  dashed_name: source-geo-continent-name
  description: Name of the continent.
  example: North America
  flat_name: source.geo.continent_name
  ignore_above: 1024
  level: core
  name: continent_name
  normalize: []
  original_fieldset: geo
  short: Name of the continent.
  type: keyword
source.geo.country_iso_code:
  dashed_name: source-geo-country-iso-code
  description: Country ISO code.
  example: CA
  flat_name: source.geo.country_iso_code
  ignore_above: 1024
  level: core
  name: country_iso_code
  normalize: []
  original_fieldset: geo
  short: Country ISO code.
  type: keyword
source.geo.country_name:
  dashed_name: source-geo-country-name
  description: Country name.
  example: Canada
  flat_name: source.geo.country_name
  ignore_above: 1024
  level: core
  name: country_name
  normalize: []
  original_fieldset: geo
  short: Country name.
  type: keyword
source.geo.location:
  dashed_name: source-geo-location
  description: Longitude and latitude.
  example: '{ "lon": -73.614830, "lat": 45.505918 }'
  flat_name: source.geo.location
  level: core
  name: location
  normalize: []
  original_fieldset: geo
  short: Longitude and latitude.
  type: geo_point
source.geo.name:
  dashed_name: source-geo-name
  description: 'User-defined description of a location, at the level of granularity
    they care about.

    Could be the name of their data centers, the floor number, if this describes a
    local physical entity, city names.

    Not typically used in automated geolocation.'
  example: boston-dc
  flat_name: source.geo.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: geo
  short: User-defined description of a location.
  type: keyword
source.geo.postal_code:
  dashed_name: source-geo-postal-code
  description: 'Postal code associated with the location.

    Values appropriate for this field may also be known as a postcode or ZIP code
    and will vary widely from country to country.'
  example: 94040
  flat_name: source.geo.postal_code
  ignore_above: 1024
  level: core
  name: postal_code
  normalize: []
  original_fieldset: geo
  short: Postal code.
  type: keyword
source.geo.region_iso_code:
  dashed_name: source-geo-region-iso-code
  description: Region ISO code.
  example: CA-QC
  flat_name: source.geo.region_iso_code
  ignore_above: 1024
  level: core
  name: region_iso_code
  normalize: []
  original_fieldset: geo
  short: Region ISO code.
  type: keyword
source.geo.region_name:
  dashed_name: source-geo-region-name
  description: Region name.
  example: Quebec
  flat_name: source.geo.region_name
  ignore_above: 1024
  level: core
  name: region_name
  normalize: []
  original_fieldset: geo
  short: Region name.
  type: keyword
source.geo.timezone:
  dashed_name: source-geo-timezone
  description: The time zone of the location, such as IANA time zone name.
  example: America/Argentina/Buenos_Aires
  flat_name: source.geo.timezone
  ignore_above: 1024
  level: core
  name: timezone
  normalize: []
  original_fieldset: geo
  short: Time zone.
  type: keyword
user.Ext:
  dashed_name: user-Ext
  description: Object for all custom defined fields to live in.
  flat_name: user.Ext
  level: custom
  name: Ext
  normalize: []
  short: Object for all custom defined fields to live in.
  type: object
user.Ext.real:
  dashed_name: user-Ext-real
  description: User info prior to any setuid operations.
  flat_name: user.Ext.real
  level: custom
  name: Ext.real
  normalize: []
  short: User info prior to any setuid operations.
  type: object
user.Ext.real.id:
  dashed_name: user-Ext-real-id
  description: One or multiple unique identifiers of the user.
  flat_name: user.Ext.real.id
  ignore_above: 1024
  level: custom
  name: Ext.real.id
  normalize: []
  short: One or multiple unique identifiers of the user.
  type: keyword
user.Ext.real.name:
  dashed_name: user-Ext-real-name
  description: Short name or login of the user.
  flat_name: user.Ext.real.name
  ignore_above: 1024
  level: custom
  name: Ext.real.name
  normalize: []
  short: Short name or login of the user.
  type: keyword
user.domain:
  dashed_name: user-domain
  description: 'Name of the directory the user is a member of.

    For example, an LDAP or Active Directory domain name.'
  flat_name: user.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  short: Name of the directory the user is a member of.
  type: keyword
user.email:
  dashed_name: user-email
  description: User email address.
  flat_name: user.email
  ignore_above: 1024
  level: extended
  name: email
  normalize: []
  short: User email address.
  type: keyword
user.full_name:
  dashed_name: user-full-name
  description: User's full name, if available.
  example: Albert Einstein
  flat_name: user.full_name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: user.full_name.text
    name: text
    type: match_only_text
  name: full_name
  normalize: []
  short: User's full name, if available.
  type: keyword
user.group.Ext:
  dashed_name: user-group-Ext
  description: Object for all custom defined fields to live in.
  flat_name: user.group.Ext
  level: custom
  name: Ext
  normalize: []
  original_fieldset: group
  short: Object for all custom defined fields to live in.
  type: object
user.group.Ext.real:
  dashed_name: user-group-Ext-real
  description: Group info prior to any setgid operations.
  flat_name: user.group.Ext.real
  level: custom
  name: Ext.real
  normalize: []
  original_fieldset: group
  short: Group info prior to any setgid operations.
  type: object
user.group.Ext.real.id:
  dashed_name: user-group-Ext-real-id
  description: Unique identifier for the group on the system/platform.
  flat_name: user.group.Ext.real.id
  ignore_above: 1024
  level: custom
  name: Ext.real.id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
user.group.Ext.real.name:
  dashed_name: user-group-Ext-real-name
  description: Name of the group.
  flat_name: user.group.Ext.real.name
  ignore_above: 1024
  level: custom
  name: Ext.real.name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
user.group.domain:
  dashed_name: user-group-domain
  description: Name of the directory the group is a member of. For example, an LDAP
    or Active Directory domain name.
  flat_name: user.group.domain
  ignore_above: 1024
  level: extended
  name: domain
  normalize: []
  original_fieldset: group
  short: Name of the directory the group is a member of.
  type: keyword
user.group.id:
  dashed_name: user-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: user.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
user.group.name:
  dashed_name: user-group-name
  description: Name of the group.
  flat_name: user.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
user.hash:
  dashed_name: user-hash
  description: 'Unique user hash to correlate information for a user in anonymized
    form.

    Useful if `user.id` or `user.name` contain confidential information and cannot
    be used.'
  flat_name: user.hash
  ignore_above: 1024
  level: extended
  name: hash
  normalize: []
  short: Unique user hash to correlate information for a user in anonymized form.
  type: keyword
user.id:
  dashed_name: user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  short: Unique identifier of the user.
  type: keyword
user.name:
  dashed_name: user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  short: Short name or login of the user.
  type: keyword