ColumnName,ColumnType,Class,Schema,LogicalType,ListOfValues,Aliased,DynamicType,ArrayValuesType AADTenantId,string,Mandatory,AssetEntity,,,,, ActingAppId,string,Optional,AgentEvent,,,,, ActingAppId,string,Optional,AuditEvent,,,,, ActingAppId,string,Optional,Authentication,,,,, ActingAppId,string,Optional,FileEvent,,,,, ActingAppId,string,Optional,UserManagement,,,,, ActingAppName,string,Optional,AgentEvent,,,,, ActingAppName,string,Optional,AuditEvent,,,,, ActingAppName,string,Optional,Authentication,,,,, ActingAppName,string,Optional,FileEvent,,,,, ActingAppName,string,Optional,UserManagement,,,,, ActingAppType,string,Optional,AgentEvent,,,,, ActingAppType,string,Optional,AuditEvent,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other,,, ActingAppType,string,Optional,Authentication,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Browser|Other,,, ActingAppType,string,Optional,FileEvent,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other,,, ActingAppType,string,Optional,UserManagement,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other,,, ActingOriginalAppType,string,Optional,AuditEvent,,,,, ActingOriginalAppType,string,Optional,Authentication,,,,, ActingOriginalAppType,string,Optional,UserManagement,,,,, ActingProcessCommandLine,string,Optional,FileEvent,,,,, ActingProcessCommandLine,string,Optional,ProcessEvent,,,,, ActingProcessCommandLine,string,Optional,RegistryEvent,,,,, ActingProcessCreationTime,datetime,Optional,ProcessEvent,,,,, ActingProcessFileCompany,string,Optional,ProcessEvent,,,,, ActingProcessFileDescription,string,Optional,ProcessEvent,,,,, ActingProcessFileInternalName,string,Optional,ProcessEvent,,,,, ActingProcessFilename,string,Optional,ProcessEvent,,,,, ActingProcessFileOriginalName,string,Optional,ProcessEvent,,,,, ActingProcessFileProduct,string,Optional,ProcessEvent,,,,, ActingProcessFileSize,long,Optional,ProcessEvent,,,,, ActingProcessFileVersion,string,Optional,ProcessEvent,,,,, ActingProcessGuid,string,Optional,FileEvent,GUID,,,, ActingProcessGuid,string,Optional,ProcessEvent,GUID,,,, ActingProcessGuid,string,Optional,RegistryEvent,GUID,,,, ActingProcessId,string,Mandatory,ProcessEvent,,,,, ActingProcessId,string,Mandatory,RegistryEvent,,,,, ActingProcessId,string,Optional,FileEvent,,,,, ActingProcessIMPHASH,string,Optional,ProcessEvent,,,,, ActingProcessInjectedAddress,string,Optional,ProcessEvent,,,,, ActingProcessIntegrityLevel,string,Optional,ProcessEvent,,,,, ActingProcessIsHidden,bool,Optional,ProcessEvent,,,,, ActingProcessMD5,string,Optional,ProcessEvent,,,,, ActingProcessName,string,Optional,FileEvent,,,,, ActingProcessName,string,Optional,ProcessEvent,,,,, ActingProcessName,string,Optional,RegistryEvent,,,,, ActingProcessSHA1,string,Optional,ProcessEvent,SHA1,,,, ActingProcessSHA256,string,Optional,ProcessEvent,SHA256,,,, ActingProcessSHA512,string,Optional,ProcessEvent,SHA512,,,, ActingProcessTokenElevation,string,Optional,ProcessEvent,,,,, ActorDNUsername,string,Optional,AuditEvent,,,,, ActorDNUsername,string,Optional,Authentication,,,,, ActorDNUsername,string,Optional,FileEvent,,,,, ActorDNUsername,string,Optional,ProcessEvent,,,,, ActorDNUsername,string,Optional,RegistryEvent,,,,, ActorDNUsername,string,Optional,UserManagement,,,,, ActorOriginalUserType,string,Optional,AuditEvent,,,,, ActorOriginalUserType,string,Optional,Authentication,,,,, ActorOriginalUserType,string,Optional,FileEvent,,,,, ActorOriginalUserType,string,Optional,ProcessEvent,,,,, ActorOriginalUserType,string,Optional,UserManagement,,,,, ActorScope,string,Optional,AuditEvent,,,,, ActorScope,string,Optional,Authentication,,,,, ActorScope,string,Optional,FileEvent,,,,, ActorScope,string,Optional,ProcessEvent,,,,, ActorScope,string,Optional,RegistryEvent,,,,, ActorScope,string,Optional,UserManagement,,,,, ActorScopeId,string,Optional,AuditEvent,,,,, ActorScopeId,string,Optional,Authentication,,,,, ActorScopeId,string,Optional,FileEvent,,,,, ActorScopeId,string,Optional,ProcessEvent,,,,, ActorScopeId,string,Optional,UserManagement,,,,, ActorSessionId,string,Optional,AuditEvent,,,,, ActorSessionId,string,Optional,Authentication,,,,, ActorSessionId,string,Optional,FileEvent,,,,, ActorSessionId,string,Optional,ProcessEvent,,,,, ActorSessionId,string,Optional,RegistryEvent,,,,, ActorSessionId,string,Optional,UserManagement,,,,, ActorSimpleUsername,string,Optional,AuditEvent,,,,, ActorSimpleUsername,string,Optional,Authentication,,,,, ActorSimpleUsername,string,Optional,FileEvent,,,,, ActorSimpleUsername,string,Optional,ProcessEvent,,,,, ActorSimpleUsername,string,Optional,RegistryEvent,,,,, ActorSimpleUsername,string,Optional,UserManagement,,,,, ActorUpn,string,Optional,FileEvent,,,,, ActorUserAadId,string,Optional,AuditEvent,,,,, ActorUserAadId,string,Optional,Authentication,,,,, ActorUserAadId,string,Optional,FileEvent,,,,, ActorUserAadId,string,Optional,ProcessEvent,,,,, ActorUserAadId,string,Optional,RegistryEvent,,,,, ActorUserAadId,string,Optional,UserManagement,,,,, ActorUserAWSId,string,Optional,AuditEvent,,,,, ActorUserAWSId,string,Optional,Authentication,,,,, ActorUserAWSId,string,Optional,FileEvent,,,,, ActorUserAWSId,string,Optional,ProcessEvent,,,,, ActorUserAWSId,string,Optional,RegistryEvent,,,,, ActorUserAWSId,string,Optional,UserManagement,,,,, ActorUserId,string,Optional,AgentEvent,,,,, ActorUserId,string,Optional,AuditEvent,,,,, ActorUserId,string,Optional,Authentication,,,,, ActorUserId,string,Optional,UserManagement,,,,, ActorUserId,string,Recommended,FileEvent,,,,, ActorUserId,string,Recommended,ProcessEvent,,,,, ActorUserId,string,Recommended,RegistryEvent,,,,, ActorUserIdType,string,Conditional,AuditEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,ActorUserId,, ActorUserIdType,string,Conditional,Authentication,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,ActorUserId,, ActorUserIdType,string,Conditional,FileEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|GWorkspaceProfileID|Other,ActorUserId,, ActorUserIdType,string,Conditional,ProcessEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,ActorUserId,, ActorUserIdType,string,Conditional,RegistryEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,ActorUserId,, ActorUserIdType,string,Conditional,UserManagement,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,ActorUserId,, ActorUserIdType,string,Optional,AgentEvent,,,,, ActorUsername,string,Mandatory,FileEvent,,,,, ActorUsername,string,Mandatory,ProcessEvent,,,,, ActorUsername,string,Mandatory,RegistryEvent,,,,, ActorUsername,string,Mandatory,UserManagement,,,,, ActorUsername,string,Optional,AgentEvent,,,,, ActorUsername,string,Optional,Authentication,,,,, ActorUsername,string,Recommended,AuditEvent,,,,, ActorUsernameType,string,Conditional,AuditEvent,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Conditional,Authentication,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Conditional,FileEvent,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Conditional,ProcessEvent,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Conditional,RegistryEvent,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Conditional,UserManagement,Enumerated,UPN|Windows|DN|Simple,ActorUsername,, ActorUsernameType,string,Optional,AgentEvent,,,,, ActorUserOktaId,string,Optional,AuditEvent,,,,, ActorUserOktaId,string,Optional,Authentication,,,,, ActorUserOktaId,string,Optional,FileEvent,,,,, ActorUserOktaId,string,Optional,ProcessEvent,,,,, ActorUserOktaId,string,Optional,RegistryEvent,,,,, ActorUserOktaId,string,Optional,UserManagement,,,,, ActorUserPuid,string,Optional,AuditEvent,,,,, ActorUserPuid,string,Optional,Authentication,,,,, ActorUserPuid,string,Optional,FileEvent,,,,, ActorUserPuid,string,Optional,ProcessEvent,,,,, ActorUserPuid,string,Optional,RegistryEvent,,,,, ActorUserPuid,string,Optional,UserManagement,,,,, ActorUserScope,string,Optional,AgentEvent,,,,, ActorUserScopeId,string,Optional,AgentEvent,,,,, ActorUserSid,string,Optional,AuditEvent,,,,, ActorUserSid,string,Optional,Authentication,,,,, ActorUserSid,string,Optional,FileEvent,,,,, ActorUserSid,string,Optional,ProcessEvent,,,,, ActorUserSid,string,Optional,RegistryEvent,,,,, ActorUserSid,string,Optional,UserManagement,,,,, ActorUserType,string,Optional,AuditEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, ActorUserType,string,Optional,Authentication,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, ActorUserType,string,Optional,FileEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, ActorUserType,string,Optional,ProcessEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, ActorUserType,string,Optional,RegistryEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, ActorUserType,string,Optional,UserManagement,Enumerated,Regular|Machine|Admin|System|Application|Service Principal|Other|Anonymous,,, ActorUserUid,string,Optional,AuditEvent,,,,, ActorUserUid,string,Optional,Authentication,,,,, ActorUserUid,string,Optional,FileEvent,,,,, ActorUserUid,string,Optional,ProcessEvent,,,,, ActorUserUid,string,Optional,RegistryEvent,,,,, ActorUserUid,string,Optional,UserManagement,,,,, ActorUserUpn,string,Optional,AuditEvent,,,,, ActorUserUpn,string,Optional,Authentication,,,,, ActorUserUpn,string,Optional,FileEvent,,,,, ActorUserUpn,string,Optional,ProcessEvent,,,,, ActorUserUpn,string,Optional,RegistryEvent,,,,, ActorUserUpn,string,Optional,UserManagement,,,,, ActorWindowsUsername,string,Optional,AuditEvent,,,,, ActorWindowsUsername,string,Optional,Authentication,,,,, ActorWindowsUsername,string,Optional,FileEvent,,,,, ActorWindowsUsername,string,Optional,ProcessEvent,,,,, ActorWindowsUsername,string,Optional,RegistryEvent,,,,, ActorWindowsUsername,string,Optional,UserManagement,,,,, AdditionalAssetOwners,dynamic,Recommended,AssetEntity,,,,array,string AdditionalFields,dynamic,Optional,AgentEvent,,,,dictionary, AdditionalFields,dynamic,Optional,AlertEvent,,,,dictionary, AdditionalFields,dynamic,Optional,AssetEntity,,,,dictionary, AdditionalFields,dynamic,Optional,AuditEvent,,,,dictionary, AdditionalFields,dynamic,Optional,Authentication,,,,dictionary, AdditionalFields,dynamic,Optional,Common,,,,dictionary, AdditionalFields,dynamic,Optional,DhcpEvent,,,,dictionary, AdditionalFields,dynamic,Optional,Dns,,,,dictionary, AdditionalFields,dynamic,Optional,FileEvent,,,,dictionary, AdditionalFields,dynamic,Optional,NetworkSession,,,,dictionary, AdditionalFields,dynamic,Optional,ProcessEvent,,,,dictionary, AdditionalFields,dynamic,Optional,RegistryEvent,,,,dictionary, AdditionalFields,dynamic,Optional,UserManagement,,,,dictionary, AdditionalFields,dynamic,Optional,WebSession,,,,dictionary, AlertDescription,string,Alias,AlertEvent,,,EventMessage,, AlertId,string,Alias,AlertEvent,,,EventUid,, AlertName,string,Recommended,AlertEvent,,,,, AlertOriginalStatus,string,Optional,AlertEvent,,,,, AlertStatus,string,Optional,AlertEvent,Enumerated,Active|Closed,,, AlertVerdict,string,Optional,AlertEvent,Enumerated,True Positive|False Positive|Benign Positive|Unknown,,, Application,string,Alias,AuditEvent,,,TargetAppName,, Application,string,Alias,Authentication,,,TargetAppName,, Application,string,Alias,FileEvent,,,TargetAppName,, ASimMatchingHostname,string,Recommended,NetworkSession,Enumerated,SrcHostname|DstHostname|Both|-,,, ASimMatchingHostname,string,Recommended,WebSession,Enumerated,SrcHostname|DstHostname|Both|-,,, ASimMatchingIpAddr,string,Recommended,NetworkSession,Enumerated,SrcIpAddr|DstIpAddr|Both|-,,, ASimMatchingIpAddr,string,Recommended,WebSession,Enumerated,SrcIpAddr|DstIpAddr|Both|-,,, AssetClassificationLastScanDateTime,datetime,Mandatory,AssetEntity,,,,, AssetIsProtectedByDlp,bool,Optional,AssetEntity,,,,, AssetOriginalDataClassificationType,dynamic,Optional,AssetEntity,,,,array,string AssetOriginalPermissions,dynamic,Optional,AssetEntity,,,,array,string AssetOriginalRiskDetails,dynamic,Optional,AssetEntity,,,,dictionary, AssetOriginalRiskLevel,string,Optional,AssetEntity,,,,, AssetOriginalSensitivityLevel,string,Optional,AssetEntity,,,,, AssetOriginalType,string,Optional,AssetEntity,,,,, AssetOwnerId,string,Mandatory,AssetEntity,,,,, AssetOwnerIdType,string,Recommended,AssetEntity,,,,, AssetOwnerScope,string,Optional,AssetEntity,,,,, AssetOwnerScopeId,string,Optional,AssetEntity,,,,, AssetOwnerType,string,Optional,AssetEntity,,,,, AssetPath,string,Alias,AssetEntity,,,FilePath,, AssetPath,string,Alias,AssetEntity,,,SitePath,, AssetRelatedIndicators,dynamic,Optional,AssetEntity,,,,array,string AssetRiskFirstReportedTime,datetime,Optional,AssetEntity,,,,, AssetRiskLastReportedTime,datetime,Optional,AssetEntity,,,,, AssetRiskLevel,string,Optional,AssetEntity,Enumerated,Info|Low|Medium|High|Critical|Other,,, AssetRiskName,string,Optional,AssetEntity,,,,, AssetSensitivityLabel,string,Mandatory,AssetEntity,Enumerated,Personal|Public|General|Confidential|Highly Confidential,,, AssetType,string,Mandatory,AssetEntity,Enumerated,File|Site,,, AttackRemediationSteps,string,Recommended,AlertEvent,,,,, AttackTactics,string,Recommended,AlertEvent,,,,, AttackTechniques,string,Recommended,AlertEvent,,,,, CommandLine,string,Alias,ProcessEvent,,,TargetProcessCommandLine,, DetectionMethod,string,Optional,AlertEvent,Enumerated,EDR|Behavioral Analytics|Reputation|Threat Intelligence|Intrusion Detection|Automated Investigation|Antivirus|Data Loss Prevention|User Defined Blocked List|Cloud Security Posture Management|Cloud Application Security|Scheduled Alerts|Other,,, DhcpCircuitId,string,Optional,DhcpEvent,,,,, DhcpLeaseDuration,int,Optional,DhcpEvent,,,,, DhcpSessionDuration,int,Optional,DhcpEvent,,,,, DhcpSessionId,string,Optional,DhcpEvent,,,,, DhcpSrcDHCId,string,Optional,DhcpEvent,,,,, DhcpSubscriberId,string,Optional,DhcpEvent,,,,, DhcpUserClass,string,Optional,DhcpEvent,,,,, DhcpUserClassId,string,Optional,DhcpEvent,,,,, DhcpVendorClass,string,Optional,DhcpEvent,,,,, DhcpVendorClassId,string,Optional,DhcpEvent,,,,, DnsFlags,string,Optional,Dns,,,,, DnsFlagsAuthenticated,bool,Optional,Dns,,,,, DnsFlagsAuthoritative,bool,Optional,Dns,,,,, DnsFlagsCheckingDisabled,bool,Optional,Dns,,,,, DnsFlagsRecursionAvailable,bool,Optional,Dns,,,,, DnsFlagsRecursionDesired,bool,Optional,Dns,,,,, DnsFlagsTruncated,bool,Optional,Dns,,,,, DnsFlagsZ,bool,Optional,Dns,,,,, DnsNetworkDuration,int,Optional,Dns,,,,, DnsQuery,string,Mandatory,Dns,RecommendedDnsDomain,,,, DnsQueryClass,int,Optional,Dns,,,,, DnsQueryClassName,string,Recommended,Dns,DnsQueryClassName,IN|CH|HS|NONE|ANY|Reserved|Unassigned,,, DnsQueryType,int,Optional,Dns,,,,, DnsQueryTypeName,string,Recommended,Dns,DnsQueryTypeName,,,, DnsResponseCode,int,Optional,Dns,,,,, DnsResponseCodeName,string,Alias,Dns,,,EventResultDetails,, DnsResponseIpCity,string,Optional,Dns,,,,, DnsResponseIpCountry,string,Optional,Dns,,,,, DnsResponseIpLatitude,real,Optional,Dns,,,,, DnsResponseIpLongitude,real,Optional,Dns,,,,, DnsResponseIpRegion,string,Optional,Dns,,,,, DnsResponseName,string,Optional,Dns,,,,, DnsSessionId,string,Optional,Dns,,,,, Domain,string,Alias,Dns,RecommendedDnsDomain,,DnsQuery,, DomainCategory,string,Alias,Dns,,,UrlCategory,, Dst,string,Mandatory,WebSession,,,,, Dst,string,Recommended,AuditEvent,,,,, Dst,string,Recommended,Authentication,,,,, Dst,string,Recommended,Dns,,,,, Dst,string,Recommended,NetworkSession,,,,, DstAppId,string,Optional,NetworkSession,,,,, DstAppId,string,Optional,WebSession,,,,, DstAppName,string,Optional,NetworkSession,,,,, DstAppName,string,Optional,WebSession,,,,, DstAppType,string,Optional,NetworkSession,Enumerated,Process|Service|Resource|URL|SaaS application|Other,,, DstAppType,string,Optional,WebSession,Enumerated,Process|Service|Resource|URL|SaaS application|Other,,, DstBytes,long,Recommended,NetworkSession,,,,, DstBytes,long,Recommended,WebSession,,,,, DstDescription,string,Optional,Dns,,,,, DstDescription,string,Optional,NetworkSession,,,,, DstDescription,string,Optional,WebSession,,,,, DstDeviceType,string,Optional,Dns,Enumerated,Computer|Mobile Device|IOT Device|Other,,, DstDeviceType,string,Optional,NetworkSession,Enumerated,Computer|Mobile Device|IOT Device|Other,,, DstDeviceType,string,Optional,WebSession,Enumerated,Computer|Mobile Device|IOT Device|Other,,, DstDNUsername,string,Optional,NetworkSession,,,,, DstDNUsername,string,Optional,WebSession,,,,, DstDomain,string,Optional,Dns,Domain,,,, DstDomain,string,Optional,WebSession,Domain,,,, DstDomain,string,Recommended,NetworkSession,Domain,,,, DstDomainType,string,Conditional,Dns,Enumerated,Windows|FQDN|ResourceGroup,DstDomain,, DstDomainType,string,Conditional,NetworkSession,Enumerated,Windows|FQDN|ResourceGroup,DstDomain,, DstDomainType,string,Conditional,WebSession,Enumerated,Windows|FQDN|ResourceGroup,DstDomain,, DstDvcId,string,Optional,Dns,,,,, DstDvcId,string,Optional,NetworkSession,,,,, DstDvcId,string,Optional,WebSession,,,,, DstDvcIdType,string,Conditional,Dns,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DstDvcId,, DstDvcIdType,string,Conditional,NetworkSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DstDvcId,, DstDvcIdType,string,Conditional,WebSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DstDvcId,, DstDvcScope,string,Optional,Dns,,,,, DstDvcScope,string,Optional,NetworkSession,,,,, DstDvcScope,string,Optional,WebSession,,,,, DstDvcScopeId,string,Optional,Dns,,,,, DstDvcScopeId,string,Optional,NetworkSession,,,,, DstDvcScopeId,string,Optional,WebSession,,,,, DstFQDN,string,Optional,Dns,FQDN,,,, DstFQDN,string,Optional,NetworkSession,FQDN,,,, DstFQDN,string,Optional,WebSession,FQDN,,,, DstGeoCity,string,Optional,Dns,,,,, DstGeoCity,string,Optional,NetworkSession,,,,, DstGeoCity,string,Optional,WebSession,,,,, DstGeoCountry,string,Optional,Dns,,,,, DstGeoCountry,string,Optional,NetworkSession,,,,, DstGeoCountry,string,Optional,WebSession,,,,, DstGeoLatitude,real,Optional,Dns,,,,, DstGeoLatitude,real,Optional,NetworkSession,,,,, DstGeoLatitude,real,Optional,WebSession,,,,, DstGeoLongitude,real,Optional,Dns,,,,, DstGeoLongitude,real,Optional,NetworkSession,,,,, DstGeoLongitude,real,Optional,WebSession,,,,, DstGeoRegion,string,Optional,Dns,,,,, DstGeoRegion,string,Optional,NetworkSession,,,,, DstGeoRegion,string,Optional,WebSession,,,,, DstHostname,string,Optional,Dns,Hostname,,,, DstHostname,string,Recommended,NetworkSession,Hostname,,,, DstHostname,string,Recommended,WebSession,Hostname,,,, DstInterfaceGuid,string,Optional,NetworkSession,GUID,,,, DstInterfaceGuid,string,Optional,WebSession,GUID,,,, DstInterfaceName,string,Optional,NetworkSession,,,,, DstInterfaceName,string,Optional,WebSession,,,,, DstIpAddr,string,Optional,Dns,IP Address,,,, DstIpAddr,string,Recommended,NetworkSession,IP Address,,,, DstIpAddr,string,Recommended,WebSession,IP Address,,,, DstMacAddr,string,Optional,NetworkSession,MAC Address,,,, DstMacAddr,string,Optional,WebSession,MAC Address,,,, DstNatIpAddr,string,Optional,NetworkSession,IP Address,,,, DstNatIpAddr,string,Optional,WebSession,IP Address,,,, DstNatPortNumber,int,Optional,NetworkSession,,,,, DstNatPortNumber,int,Optional,WebSession,,,,, DstOriginalRiskLevel,string,Optional,Dns,,,,, DstOriginalUserType,string,Optional,NetworkSession,,,,, DstOriginalUserType,string,Optional,WebSession,,,,, DstPackets,long,Optional,NetworkSession,,,,, DstPackets,long,Optional,WebSession,,,,, DstPortNumber,int,Optional,Dns,,,,, DstPortNumber,int,Optional,NetworkSession,,,,, DstPortNumber,int,Optional,WebSession,,,,, DstProcessGuid,string,Optional,NetworkSession,,,,, DstProcessGuid,string,Optional,WebSession,,,,, DstProcessId,string,Optional,NetworkSession,,,,, DstProcessId,string,Optional,WebSession,,,,, DstProcessName,string,Optional,NetworkSession,,,,, DstProcessName,string,Optional,WebSession,,,,, DstRiskLevel,int,Optional,Dns,,,,, DstSimpleUsername,string,Optional,NetworkSession,,,,, DstSimpleUsername,string,Optional,WebSession,,,,, DstUserAadId,string,Optional,NetworkSession,,,,, DstUserAadId,string,Optional,WebSession,,,,, DstUserAWSId,string,Optional,NetworkSession,,,,, DstUserAWSId,string,Optional,WebSession,,,,, DstUserId,string,Optional,NetworkSession,,,,, DstUserId,string,Optional,WebSession,,,,, DstUserIdType,string,Conditional,NetworkSession,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,DstUserId,, DstUserIdType,string,Conditional,WebSession,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,DstUserId,, DstUsername,string,Optional,NetworkSession,,,,, DstUsername,string,Optional,WebSession,,,,, DstUsernameType,string,Conditional,NetworkSession,Enumerated,UPN|Windows|DN|Simple,DstUsername,, DstUsernameType,string,Conditional,WebSession,Enumerated,UPN|Windows|DN|Simple,DstUsername,, DstUserOktaId,string,Optional,NetworkSession,,,,, DstUserOktaId,string,Optional,WebSession,,,,, DstUserPuid,string,Optional,NetworkSession,,,,, DstUserPuid,string,Optional,WebSession,,,,, DstUserScope,string,Optional,NetworkSession,,,,, DstUserScope,string,Optional,WebSession,,,,, DstUserScopeId,string,Optional,NetworkSession,,,,, DstUserScopeId,string,Optional,WebSession,,,,, DstUserSid,string,Optional,NetworkSession,,,,, DstUserSid,string,Optional,WebSession,,,,, DstUserType,string,Optional,NetworkSession,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, DstUserType,string,Optional,WebSession,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, DstUserUid,string,Optional,NetworkSession,,,,, DstUserUid,string,Optional,WebSession,,,,, DstUserUpn,string,Optional,NetworkSession,,,,, DstUserUpn,string,Optional,WebSession,,,,, DstVlanId,string,Optional,NetworkSession,,,,, DstVlanId,string,Optional,WebSession,,,,, DstWindowsUsername,string,Optional,NetworkSession,,,,, DstWindowsUsername,string,Optional,WebSession,,,,, DstZone,string,Optional,NetworkSession,,,,, DstZone,string,Optional,WebSession,,,,, Duration,int,Alias,DhcpEvent,,,DhcpSessionDuration,, Duration,int,Alias,Dns,,,DnsNetworkDuration,, Duration,int,Alias,NetworkSession,,,NetworkDuration,, Duration,int,Alias,WebSession,,,NetworkDuration,, Dvc,string,Mandatory,AuditEvent,,,,, Dvc,string,Mandatory,Authentication,,,,, Dvc,string,Mandatory,Common,,,,, Dvc,string,Mandatory,DhcpEvent,,,,, Dvc,string,Mandatory,Dns,,,,, Dvc,string,Mandatory,NetworkSession,,,,, Dvc,string,Mandatory,ProcessEvent,Hostname,,,, Dvc,string,Mandatory,RegistryEvent,Hostname,,,, Dvc,string,Mandatory,UserManagement,,,,, Dvc,string,Mandatory,WebSession,,,,, Dvc,string,Optional,FileEvent,,,,, DvcAction,string,Optional,AlertEvent,,,,, DvcAction,string,Optional,Common,,,,, DvcAction,string,Optional,Dns,,,,, DvcAction,string,Optional,ProcessEvent,,,,, DvcAction,string,Optional,RegistryEvent,,,,, DvcAction,string,Optional,WebSession,Enumerated,Allow|Deny|Drop|Drop ICMP|Reset|Reset Source|Reset Destination|Encrypt|Decrypt|VPNroute,,, DvcAction,string,Recommended,AuditEvent,,,,, DvcAction,string,Recommended,Authentication,,,,, DvcAction,string,Recommended,DhcpEvent,,,,, DvcAction,string,Recommended,FileEvent,,,,, DvcAction,string,Recommended,NetworkSession,Enumerated,Allow|Deny|Drop|Drop ICMP|Reset|Reset Source|Reset Destination|Encrypt|Decrypt|VPNroute,,, DvcAction,string,Recommended,UserManagement,,,,, DvcDescription,string,Optional,AlertEvent,,,,, DvcDescription,string,Optional,AuditEvent,,,,, DvcDescription,string,Optional,Authentication,,,,, DvcDescription,string,Optional,Common,,,,, DvcDescription,string,Optional,DhcpEvent,,,,, DvcDescription,string,Optional,Dns,,,,, DvcDescription,string,Optional,FileEvent,,,,, DvcDescription,string,Optional,NetworkSession,,,,, DvcDescription,string,Optional,ProcessEvent,,,,, DvcDescription,string,Optional,RegistryEvent,,,,, DvcDescription,string,Optional,UserManagement,,,,, DvcDescription,string,Optional,WebSession,,,,, DvcDomain,string,Optional,AlertEvent,,,,, DvcDomain,string,Recommended,AuditEvent,,,,, DvcDomain,string,Recommended,Authentication,Domain,,,, DvcDomain,string,Recommended,Common,Domain,,,, DvcDomain,string,Recommended,DhcpEvent,Domain,,,, DvcDomain,string,Recommended,Dns,Domain,,,, DvcDomain,string,Recommended,FileEvent,,,,, DvcDomain,string,Recommended,NetworkSession,Domain,,,, DvcDomain,string,Recommended,ProcessEvent,Domain,,,, DvcDomain,string,Recommended,RegistryEvent,Domain,,,, DvcDomain,string,Recommended,UserManagement,,,,, DvcDomain,string,Recommended,WebSession,Domain,,,, DvcDomainType,string,Conditional,AlertEvent,Enumerated,Windows|FQDN,DvcDomain,, DvcDomainType,string,Conditional,AuditEvent,Enumerated,Windows|FQDN,DvcDomain,, DvcDomainType,string,Conditional,Authentication,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,Common,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,DhcpEvent,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,Dns,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,FileEvent,Enumerated,Windows|FQDN,DvcDomain,, DvcDomainType,string,Conditional,NetworkSession,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,ProcessEvent,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,RegistryEvent,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcDomainType,string,Conditional,UserManagement,Enumerated,Windows|FQDN,DvcDomain,, DvcDomainType,string,Conditional,WebSession,Enumerated,Windows|FQDN|ResourceGroup,DvcDomain,, DvcFQDN,string,Optional,AlertEvent,FQDN,,,, DvcFQDN,string,Optional,AuditEvent,FQDN,,,, DvcFQDN,string,Optional,Authentication,FQDN,,,, DvcFQDN,string,Optional,Common,FQDN,,,, DvcFQDN,string,Optional,DhcpEvent,FQDN,,,, DvcFQDN,string,Optional,Dns,FQDN,,,, DvcFQDN,string,Optional,FileEvent,FQDN,,,, DvcFQDN,string,Optional,NetworkSession,FQDN,,,, DvcFQDN,string,Optional,ProcessEvent,FQDN,,,, DvcFQDN,string,Optional,RegistryEvent,FQDN,,,, DvcFQDN,string,Optional,WebSession,FQDN,,,, DvcFQDN,string,Recommended,UserManagement,FQDN,,,, DvcHostname,string,Recommended,AlertEvent,Hostname,,,, DvcHostname,string,Recommended,AuditEvent,Hostname,,,, DvcHostname,string,Recommended,Authentication,Hostname,,,, DvcHostname,string,Recommended,Common,Hostname,,,, DvcHostname,string,Recommended,DhcpEvent,Hostname,,,, DvcHostname,string,Recommended,Dns,Hostname,,,, DvcHostname,string,Recommended,FileEvent,Hostname,,,, DvcHostname,string,Recommended,NetworkSession,Hostname,,,, DvcHostname,string,Recommended,ProcessEvent,Hostname,,,, DvcHostname,string,Recommended,RegistryEvent,Hostname,,,, DvcHostname,string,Recommended,UserManagement,Hostname,,,, DvcHostname,string,Recommended,WebSession,Hostname,,,, DvcId,string,Optional,AuditEvent,,,,, DvcId,string,Optional,Authentication,,,,, DvcId,string,Optional,Common,,,,, DvcId,string,Optional,DhcpEvent,,,,, DvcId,string,Optional,Dns,,,,, DvcId,string,Optional,FileEvent,,,,, DvcId,string,Optional,NetworkSession,,,,, DvcId,string,Optional,ProcessEvent,,,,, DvcId,string,Optional,RegistryEvent,,,,, DvcId,string,Optional,WebSession,,,,, DvcId,string,Recommended,AlertEvent,,,,, DvcId,string,Recommended,UserManagement,,,,, DvcIdType,string,Conditional,AlertEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|FQDN|Other,DvcId,, DvcIdType,string,Conditional,AuditEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|Other,DvcId,, DvcIdType,string,Conditional,Authentication,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,Common,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,DhcpEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,Dns,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,FileEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,NetworkSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Conditional,WebSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Optional,ProcessEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Optional,RegistryEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcIdType,string,Recommended,UserManagement,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,DvcId,, DvcInboundInterface,string,Optional,NetworkSession,,,,, DvcInboundInterface,string,Optional,WebSession,,,,, DvcInterface,string,Optional,AlertEvent,,,,, DvcInterface,string,Optional,AuditEvent,,,,, DvcInterface,string,Optional,Authentication,,,,, DvcInterface,string,Optional,Common,,,,, DvcInterface,string,Optional,DhcpEvent,,,,, DvcInterface,string,Optional,Dns,,,,, DvcInterface,string,Optional,FileEvent,,,,, DvcInterface,string,Optional,NetworkSession,,,,, DvcInterface,string,Optional,ProcessEvent,,,,, DvcInterface,string,Optional,RegistryEvent,,,,, DvcInterface,string,Optional,UserManagement,,,,, DvcInterface,string,Optional,WebSession,,,,, DvcIpAddr,string,Recommended,AlertEvent,IP Address,,,, DvcIpAddr,string,Recommended,AuditEvent,IP Address,,,, DvcIpAddr,string,Recommended,Authentication,IP Address,,,, DvcIpAddr,string,Recommended,Common,IP Address,,,, DvcIpAddr,string,Recommended,DhcpEvent,IP Address,,,, DvcIpAddr,string,Recommended,Dns,IP Address,,,, DvcIpAddr,string,Recommended,FileEvent,IP Address,,,, DvcIpAddr,string,Recommended,NetworkSession,IP Address,,,, DvcIpAddr,string,Recommended,ProcessEvent,IP Address,,,, DvcIpAddr,string,Recommended,RegistryEvent,IP Address,,,, DvcIpAddr,string,Recommended,UserManagement,IP Address,,,, DvcIpAddr,string,Recommended,WebSession,IP Address,,,, DvcMacAddr,string,Optional,AlertEvent,,,,, DvcMacAddr,string,Optional,AuditEvent,MAC Address,,,, DvcMacAddr,string,Optional,Authentication,MAC Address,,,, DvcMacAddr,string,Optional,Common,MAC Address,,,, DvcMacAddr,string,Optional,DhcpEvent,MAC Address,,,, DvcMacAddr,string,Optional,Dns,MAC Address,,,, DvcMacAddr,string,Optional,FileEvent,MAC Address,,,, DvcMacAddr,string,Optional,NetworkSession,MAC Address,,,, DvcMacAddr,string,Optional,ProcessEvent,MAC Address,,,, DvcMacAddr,string,Optional,RegistryEvent,MAC Address,,,, DvcMacAddr,string,Optional,UserManagement,MAC Address,,,, DvcMacAddr,string,Optional,WebSession,MAC Address,,,, DvcOriginalAction,string,Optional,AlertEvent,,,,, DvcOriginalAction,string,Optional,AuditEvent,,,,, DvcOriginalAction,string,Optional,Authentication,,,,, DvcOriginalAction,string,Optional,Common,,,,, DvcOriginalAction,string,Optional,DhcpEvent,,,,, DvcOriginalAction,string,Optional,Dns,,,,, DvcOriginalAction,string,Optional,FileEvent,,,,, DvcOriginalAction,string,Optional,NetworkSession,,,,, DvcOriginalAction,string,Optional,ProcessEvent,,,,, DvcOriginalAction,string,Optional,RegistryEvent,,,,, DvcOriginalAction,string,Optional,UserManagement,,,,, DvcOriginalAction,string,Optional,WebSession,,,,, DvcOs,string,Optional,AlertEvent,,,,, DvcOs,string,Optional,AuditEvent,,,,, DvcOs,string,Optional,Authentication,,,,, DvcOs,string,Optional,Common,,,,, DvcOs,string,Optional,DhcpEvent,,,,, DvcOs,string,Optional,Dns,,,,, DvcOs,string,Optional,FileEvent,,,,, DvcOs,string,Optional,NetworkSession,,,,, DvcOs,string,Optional,ProcessEvent,,,,, DvcOs,string,Optional,RegistryEvent,,,,, DvcOs,string,Optional,UserManagement,,,,, DvcOs,string,Optional,WebSession,,,,, DvcOsVersion,string,Optional,AlertEvent,,,,, DvcOsVersion,string,Optional,AuditEvent,,,,, DvcOsVersion,string,Optional,Authentication,,,,, DvcOsVersion,string,Optional,Common,,,,, DvcOsVersion,string,Optional,DhcpEvent,,,,, DvcOsVersion,string,Optional,Dns,,,,, DvcOsVersion,string,Optional,FileEvent,,,,, DvcOsVersion,string,Optional,NetworkSession,,,,, DvcOsVersion,string,Optional,ProcessEvent,,,,, DvcOsVersion,string,Optional,RegistryEvent,,,,, DvcOsVersion,string,Optional,UserManagement,,,,, DvcOsVersion,string,Optional,WebSession,,,,, DvcOutboundInterface,string,Optional,NetworkSession,,,,, DvcOutboundInterface,string,Optional,WebSession,,,,, DvcScope,string,Optional,AlertEvent,,,,, DvcScope,string,Optional,AuditEvent,,,,, DvcScope,string,Optional,Authentication,,,,, DvcScope,string,Optional,Common,,,,, DvcScope,string,Optional,DhcpEvent,,,,, DvcScope,string,Optional,Dns,,,,, DvcScope,string,Optional,FileEvent,,,,, DvcScope,string,Optional,NetworkSession,,,,, DvcScope,string,Optional,ProcessEvent,,,,, DvcScope,string,Optional,RegistryEvent,,,,, DvcScope,string,Optional,UserManagement,,,,, DvcScope,string,Optional,WebSession,,,,, DvcScopeId,string,Optional,AlertEvent,,,,, DvcScopeId,string,Optional,AuditEvent,,,,, DvcScopeId,string,Optional,Authentication,,,,, DvcScopeId,string,Optional,Common,,,,, DvcScopeId,string,Optional,DhcpEvent,,,,, DvcScopeId,string,Optional,Dns,,,,, DvcScopeId,string,Optional,FileEvent,,,,, DvcScopeId,string,Optional,NetworkSession,,,,, DvcScopeId,string,Optional,ProcessEvent,,,,, DvcScopeId,string,Optional,RegistryEvent,,,,, DvcScopeId,string,Optional,UserManagement,,,,, DvcScopeId,string,Optional,WebSession,,,,, DvcZone,string,Optional,AlertEvent,,,,, DvcZone,string,Optional,AuditEvent,,,,, DvcZone,string,Optional,Authentication,,,,, DvcZone,string,Optional,Common,,,,, DvcZone,string,Optional,DhcpEvent,,,,, DvcZone,string,Optional,Dns,,,,, DvcZone,string,Optional,FileEvent,,,,, DvcZone,string,Optional,NetworkSession,,,,, DvcZone,string,Optional,ProcessEvent,,,,, DvcZone,string,Optional,RegistryEvent,,,,, DvcZone,string,Optional,UserManagement,,,,, DvcZone,string,Optional,WebSession,,,,, EmailMessageId,string,Optional,AlertEvent,,,,, EmailSubject,string,Optional,AlertEvent,,,,, EntityCreatedTime,datetime,Mandatory,AssetEntity,,,,, EntityFeedType,string,Optional,AssetEntity,Enumerated,Snapshot|Changefeed,,, EntityId,string,Mandatory,AssetEntity,,,,, EntityIdType,string,Mandatory,AssetEntity,,,,, EntityIngestionTime,datetime,Optional,AssetEntity,,,,, EntityIsDeleted,bool,Optional,AssetEntity,,,,, EntityKey,string,Optional,AssetEntity,,,,, EntityLastAccessedTime,datetime,Optional,AssetEntity,,,,, EntityLastModifiedTime,datetime,Mandatory,AssetEntity,,,,, EntityName,string,Mandatory,AssetEntity,,,,, EntityNameType,string,Recommended,AssetEntity,,,,, EntityOriginalId,string,Optional,AssetEntity,,,,, EntityOriginalSource,string,Optional,AssetEntity,,,,, EntityProduct,string,Mandatory,AssetEntity,,,,, EntitySchema,string,Mandatory,AssetEntity,,,,, EntitySnapshotId,string,Optional,AssetEntity,,,,, EntitySchemaVersion,string,Mandatory,AssetEntity,,,,, EntitySource,string,Mandatory,AssetEntity,Enumerated,Azure|Microsoft365|GCP|AWS|Snowflake|Databricks|Salesforce|Other,,, EntitySubProduct,string,Mandatory,AssetEntity,,,,, EntityUpdatedTime,datetime,Mandatory,AssetEntity,,,,, EntityVendor,string,Mandatory,AssetEntity,,,,, EventCount,int,Mandatory,AgentEvent,,,,, EventCount,int,Mandatory,AlertEvent,,,,, EventCount,int,Mandatory,AuditEvent,,,,, EventCount,int,Mandatory,Authentication,,,,, EventCount,int,Mandatory,Common,,,,, EventCount,int,Mandatory,DhcpEvent,,,,, EventCount,int,Mandatory,Dns,,,,, EventCount,int,Mandatory,FileEvent,,,,, EventCount,int,Mandatory,NetworkSession,,,,, EventCount,int,Mandatory,ProcessEvent,,,,, EventCount,int,Mandatory,RegistryEvent,,,,, EventCount,int,Mandatory,UserManagement,,,,, EventCount,int,Mandatory,WebSession,,,,, EventEndTime,datetime,Mandatory,AgentEvent,,,,, EventEndTime,datetime,Mandatory,AlertEvent,,,,, EventEndTime,datetime,Mandatory,AuditEvent,,,,, EventEndTime,datetime,Mandatory,Authentication,,,,, EventEndTime,datetime,Mandatory,Common,,,,, EventEndTime,datetime,Mandatory,DhcpEvent,,,,, EventEndTime,datetime,Mandatory,Dns,,,,, EventEndTime,datetime,Mandatory,FileEvent,,,,, EventEndTime,datetime,Mandatory,NetworkSession,,,,, EventEndTime,datetime,Mandatory,ProcessEvent,,,,, EventEndTime,datetime,Mandatory,RegistryEvent,,,,, EventEndTime,datetime,Mandatory,UserManagement,,,,, EventEndTime,datetime,Mandatory,WebSession,,,,, EventErrorDetails,string,Optional,AgentEvent,,,,, EventFinishReasons,dynamic,Optional,AgentEvent,,,,array,string EventMessage,string,Optional,AlertEvent,,,,, EventMessage,string,Optional,AuditEvent,,,,, EventMessage,string,Optional,Authentication,,,,, EventMessage,string,Optional,Common,,,,, EventMessage,string,Optional,DhcpEvent,,,,, EventMessage,string,Optional,Dns,,,,, EventMessage,string,Optional,FileEvent,,,,, EventMessage,string,Optional,NetworkSession,,,,, EventMessage,string,Optional,ProcessEvent,,,,, EventMessage,string,Optional,RegistryEvent,,,,, EventMessage,string,Optional,UserManagement,,,,, EventMessage,string,Optional,WebSession,,,,, EventOriginalErrorType,string,Optional,AgentEvent,,,,, EventOriginalRequestDetails,string,Optional,AgentEvent,,,,, EventOriginalResultDetails,string,Optional,AgentEvent,,,,, EventOriginalResultDetails,string,Optional,AuditEvent,,,,, EventOriginalResultDetails,string,Optional,Authentication,,,,, EventOriginalResultDetails,string,Optional,Common,,,,, EventOriginalResultDetails,string,Optional,DhcpEvent,,,,, EventOriginalResultDetails,string,Optional,Dns,,,,, EventOriginalResultDetails,string,Optional,FileEvent,,,,, EventOriginalResultDetails,string,Optional,NetworkSession,,,,, EventOriginalResultDetails,string,Optional,ProcessEvent,,,,, EventOriginalResultDetails,string,Optional,RegistryEvent,,,,, EventOriginalResultDetails,string,Optional,UserManagement,,,,, EventOriginalResultDetails,string,Optional,WebSession,,,,, EventOriginalSeverity,string,Optional,AlertEvent,,,,, EventOriginalSeverity,string,Optional,AuditEvent,,,,, EventOriginalSeverity,string,Optional,Authentication,,,,, EventOriginalSeverity,string,Optional,Common,,,,, EventOriginalSeverity,string,Optional,DhcpEvent,,,,, EventOriginalSeverity,string,Optional,Dns,,,,, EventOriginalSeverity,string,Optional,FileEvent,,,,, EventOriginalSeverity,string,Optional,NetworkSession,,,,, EventOriginalSeverity,string,Optional,ProcessEvent,,,,, EventOriginalSeverity,string,Optional,RegistryEvent,,,,, EventOriginalSeverity,string,Optional,UserManagement,,,,, EventOriginalSeverity,string,Optional,WebSession,,,,, EventOriginalSubType,string,Optional,AlertEvent,,,,, EventOriginalSubType,string,Optional,AuditEvent,,,,, EventOriginalSubType,string,Optional,Authentication,,,,, EventOriginalSubType,string,Optional,Common,,,,, EventOriginalSubType,string,Optional,DhcpEvent,,,,, EventOriginalSubType,string,Optional,Dns,,,,, EventOriginalSubType,string,Optional,FileEvent,,,,, EventOriginalSubType,string,Optional,NetworkSession,,,,, EventOriginalSubType,string,Optional,ProcessEvent,,,,, EventOriginalSubType,string,Optional,RegistryEvent,,,,, EventOriginalSubType,string,Optional,UserManagement,,,,, EventOriginalSubType,string,Optional,WebSession,,,,, EventOriginalType,string,Optional,AgentEvent,,,,, EventOriginalType,string,Optional,AlertEvent,,,,, EventOriginalType,string,Optional,AuditEvent,,,,, EventOriginalType,string,Optional,Authentication,,,,, EventOriginalType,string,Optional,Common,,,,, EventOriginalType,string,Optional,DhcpEvent,,,,, EventOriginalType,string,Optional,Dns,,,,, EventOriginalType,string,Optional,FileEvent,,,,, EventOriginalType,string,Optional,NetworkSession,,,,, EventOriginalType,string,Optional,ProcessEvent,,,,, EventOriginalType,string,Optional,RegistryEvent,,,,, EventOriginalType,string,Optional,UserManagement,,,,, EventOriginalType,string,Optional,WebSession,,,,, EventOriginalUid,string,Optional,AgentEvent,,,,, EventOriginalUid,string,Optional,AlertEvent,,,,, EventOriginalUid,string,Optional,AuditEvent,,,,, EventOriginalUid,string,Optional,Authentication,,,,, EventOriginalUid,string,Optional,Common,,,,, EventOriginalUid,string,Optional,DhcpEvent,,,,, EventOriginalUid,string,Optional,Dns,,,,, EventOriginalUid,string,Optional,FileEvent,,,,, EventOriginalUid,string,Optional,NetworkSession,,,,, EventOriginalUid,string,Optional,ProcessEvent,,,,, EventOriginalUid,string,Optional,RegistryEvent,,,,, EventOriginalUid,string,Optional,UserManagement,,,,, EventOriginalUid,string,Optional,WebSession,,,,, EventOutputType,string,Optional,AgentEvent,,,,, EventOwner,string,Optional,AlertEvent,,,,, EventOwner,string,Optional,AuditEvent,,,,, EventOwner,string,Optional,Authentication,,,,, EventOwner,string,Optional,Common,,,,, EventOwner,string,Optional,DhcpEvent,,,,, EventOwner,string,Optional,Dns,,,,, EventOwner,string,Optional,FileEvent,,,,, EventOwner,string,Optional,NetworkSession,,,,, EventOwner,string,Optional,ProcessEvent,,,,, EventOwner,string,Optional,RegistryEvent,,,,, EventOwner,string,Optional,UserManagement,,,,, EventOwner,string,Optional,WebSession,,,,, EventProduct,string,Mandatory,Common,,,,, EventProductVersion,string,Optional,AlertEvent,,,,, EventProductVersion,string,Optional,AuditEvent,,,,, EventProductVersion,string,Optional,Authentication,,,,, EventProductVersion,string,Optional,Common,,,,, EventProductVersion,string,Optional,DhcpEvent,,,,, EventProductVersion,string,Optional,Dns,,,,, EventProductVersion,string,Optional,FileEvent,,,,, EventProductVersion,string,Optional,NetworkSession,,,,, EventProductVersion,string,Optional,ProcessEvent,,,,, EventProductVersion,string,Optional,RegistryEvent,,,,, EventProductVersion,string,Optional,UserManagement,,,,, EventProductVersion,string,Optional,WebSession,,,,, EventReportUrl,string,Optional,AlertEvent,,,,, EventReportUrl,string,Optional,AuditEvent,URL,,,, EventReportUrl,string,Optional,Authentication,URL,,,, EventReportUrl,string,Optional,Common,URL,,,, EventReportUrl,string,Optional,DhcpEvent,URL,,,, EventReportUrl,string,Optional,Dns,URL,,,, EventReportUrl,string,Optional,FileEvent,URL,,,, EventReportUrl,string,Optional,NetworkSession,URL,,,, EventReportUrl,string,Optional,ProcessEvent,URL,,,, EventReportUrl,string,Optional,RegistryEvent,URL,,,, EventReportUrl,string,Optional,UserManagement,,,,, EventReportUrl,string,Optional,WebSession,URL,,,, EventRequestFrequencyPenalty,double,Optional,AgentEvent,,,,, EventRequestId,string,Optional,AgentEvent,,,,, EventRequestPresencePenalty,double,Optional,AgentEvent,,,,, EventRequestSeed,long,Optional,AgentEvent,,,,, EventRequestTemperature,double,Optional,AgentEvent,,,,, EventRequestTopP,double,Optional,AgentEvent,,,,, EventResponseId,string,Optional,AgentEvent,,,,, EventResult,string,Mandatory,AuditEvent,Enumerated,Success|Failure|Partial|NA,,, EventResult,string,Mandatory,Authentication,Enumerated,Success|Failure|Partial|NA,,, EventResult,string,Mandatory,Common,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Mandatory,DhcpEvent,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Mandatory,Dns,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Mandatory,FileEvent,Enumerated,Success|Failure|Partial|NA,,, EventResult,string,Mandatory,NetworkSession,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Mandatory,ProcessEvent,Enumerated,Success|Failure|Partial|NA,,, EventResult,string,Mandatory,RegistryEvent,Enumerated,Success|Failure|Partial|NA,,, EventResult,string,Mandatory,UserManagement,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Mandatory,WebSession,Enumerated,Success|Partial|Failure|NA,,, EventResult,string,Optional,AlertEvent,,,,, EventResultDetails,string,Mandatory,Dns,Enumerated,,,, EventResultDetails,string,Optional,FileEvent,,,,, EventResultDetails,string,Optional,ProcessEvent,,,,, EventResultDetails,string,Optional,RegistryEvent,,,,, EventResultDetails,string,Recommended,AuditEvent,Enumerated,,,, EventResultDetails,string,Recommended,Authentication,Enumerated,No such user or password|Incorrect password|Account expired|Password expired|User locked|User disabled|Logon violates policy|Session expired|No such user|Incorrect key|MFA not satisfied|Other,,, EventResultDetails,string,Recommended,Common,Enumerated,Placeholder,,, EventResultDetails,string,Recommended,DhcpEvent,,,,, EventResultDetails,string,Recommended,NetworkSession,Enumerated,Failover|Invalid TCP|Invalid Tunnel|Maximum Retry|Reset|Routing issue|Simulation|Terminated|Timeout|Transient error|Unknown|NA,,, EventResultDetails,string,Recommended,UserManagement,Enumerated,NotAuthorized|Other,,, EventResultDetails,string,Recommended,WebSession,Enumerated,,,, EventSchema,string,Mandatory,AgentEvent,Enumerated,AgentEvent,,, EventSchema,string,Mandatory,AlertEvent,Enumerated,AlertEvent,,, EventSchema,string,Mandatory,AuditEvent,Enumerated,AuditEvent,,, EventSchema,string,Mandatory,Authentication,Enumerated,Authentication,,, EventSchema,string,Mandatory,Common,Enumerated,Placeholder,,, EventSchema,string,Mandatory,DhcpEvent,Enumerated,DhcpEvent,,, EventSchema,string,Mandatory,Dns,Enumerated,Dns,,, EventSchema,string,Mandatory,FileEvent,Enumerated,FileEvent,,, EventSchema,string,Mandatory,NetworkSession,Enumerated,NetworkSession,,, EventSchema,string,Mandatory,ProcessEvent,Enumerated,ProcessEvent,,, EventSchema,string,Mandatory,RegistryEvent,Enumerated,RegistryEvent,,, EventSchema,string,Mandatory,UserManagement,Enumerated,UserManagement,,, EventSchema,string,Mandatory,WebSession,Enumerated,WebSession,,, EventSchemaVersion,string,Mandatory,AgentEvent,,,,, EventSchemaVersion,string,Mandatory,AlertEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,AuditEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,Authentication,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,Common,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,DhcpEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,Dns,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,FileEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,NetworkSession,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,ProcessEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,RegistryEvent,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,UserManagement,SchemaVersion,,,, EventSchemaVersion,string,Mandatory,WebSession,SchemaVersion,,,, EventSessionId,string,Optional,AgentEvent,,,,, EventSessionName,string,Optional,AgentEvent,,,,, EventSeverity,string,Mandatory,UserManagement,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Mandatory,WebSession,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Optional,Dns,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Optional,NetworkSession,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Optional,ProcessEvent,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,AlertEvent,Enumerated,High|Medium|Low|Informational,,, EventSeverity,string,Recommended,AuditEvent,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,Authentication,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,Common,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,DhcpEvent,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,FileEvent,Enumerated,Informational|Low|Medium|High,,, EventSeverity,string,Recommended,RegistryEvent,Enumerated,Informational|Low|Medium|High,,, EventStartTime,datetime,Mandatory,AgentEvent,,,,, EventStartTime,datetime,Mandatory,AlertEvent,,,,, EventStartTime,datetime,Mandatory,AuditEvent,,,,, EventStartTime,datetime,Mandatory,Authentication,,,,, EventStartTime,datetime,Mandatory,Common,,,,, EventStartTime,datetime,Mandatory,DhcpEvent,,,,, EventStartTime,datetime,Mandatory,Dns,,,,, EventStartTime,datetime,Mandatory,FileEvent,,,,, EventStartTime,datetime,Mandatory,NetworkSession,,,,, EventStartTime,datetime,Mandatory,ProcessEvent,,,,, EventStartTime,datetime,Mandatory,RegistryEvent,,,,, EventStartTime,datetime,Mandatory,UserManagement,,,,, EventStartTime,datetime,Mandatory,WebSession,,,,, EventSubType,string,Optional,AuditEvent,,,,, EventSubType,string,Optional,Authentication,Enumerated,System|Interactive|RemoteInteractive|Service|RemoteService|Remote|AssumeRole|NetworkCleartext,,, EventSubType,string,Optional,Common,Enumerated,Placeholder,,, EventSubType,string,Optional,DhcpEvent,,,,, EventSubType,string,Optional,Dns,Enumerated,request|response,,, EventSubType,string,Optional,FileEvent,Enumerated,Upload|Checkin|Download|Preview|Checkout|Extended|Recycle|Versions|Site,,, EventSubType,string,Optional,NetworkSession,Enumerated,Start|End|,,, EventSubType,string,Optional,ProcessEvent,,,,, EventSubType,string,Optional,RegistryEvent,,,,, EventSubType,string,Optional,UserManagement,Enumerated,UserRead|UserCreated|GroupCreated|UserModified|GroupModified|password|shell|GID|expiration|UID,,, EventSubType,string,Optional,WebSession,,,,, EventSubType,string,Recommended,AlertEvent,Enumerated,Threat|Suspicious Activity|Policy Violation|Anomaly|Compliance Violation| Vulnerability,,, EventThoughtProcessDetails,string,Optional,AgentEvent,,,,, EventThoughtProcessId,string,Optional,AgentEvent,,,,, EventType,string,Mandatory,AlertEvent,Enumerated,Alert,,, EventType,string,Mandatory,AuditEvent,Enumerated,Set|Read|Create|Delete|Execute|Install|Clear|Enable|Disable|Initialize|Start|Stop|Terminate|Other,,, EventType,string,Mandatory,Authentication,Enumerated,Logon|Logoff|Elevate,,, EventType,string,Mandatory,Common,Enumerated,Placeholder,,, EventType,string,Mandatory,DhcpEvent,Enumerated,Assign|Renew|Release|DNS Update|,,, EventType,string,Mandatory,Dns,Enumerated,Query|Status|Notify|Update|DNS Stateful Operations,,, EventType,string,Mandatory,FileEvent,Enumerated,FileAccessed|FileCreated|FileModified|FileDeleted|FileRenamed|FileCopied|FileMoved|FolderCreated|FolderDeleted|FolderMoved|FolderCopied|FolderModified|FileCreatedOrModified|FileAttributesUpdated|FolderAttributesAccessed,,, EventType,string,Mandatory,NetworkSession,Enumerated,NetworkSession|L2NetworkSession|EndpointNetworkSession|Flow|IDS,,, EventType,string,Mandatory,ProcessEvent,Enumerated,ProcessCreated|ProcessTerminated,,, EventType,string,Mandatory,RegistryEvent,Enumerated,RegistryKeyCreated|RegistryKeyDeleted|RegistryKeyRenamed|RegistryValueDeleted|RegistryValueSet,,, EventType,string,Mandatory,UserManagement,Enumerated,UserCreated|UserDeleted|UserModified|UserLocked|UserUnlocked|UserDisabled|UserEnabled|PasswordChanged|PasswordReset|GroupCreated|GroupDeleted|GroupModified|UserAddedToGroup|UserRemovedFromGroup|GroupEnumerated|UserRead|GroupRead,,, EventType,string,Mandatory,WebSession,Enumerated,HTTPsession|WebServerSession|ApiRequest,,, EventType,string,Mandatory,AgentEvent,,,,, EventUid,string,Mandatory,AgentEvent,,,,, EventUid,string,Mandatory,AlertEvent,,,,, EventUid,string,Recommended,AuditEvent,,,,, EventUid,string,Recommended,Authentication,,,,, EventUid,string,Recommended,Common,,,,, EventUid,string,Recommended,DhcpEvent,,,,, EventUid,string,Recommended,Dns,,,,, EventUid,string,Recommended,FileEvent,,,,, EventUid,string,Recommended,NetworkSession,,,,, EventUid,string,Recommended,ProcessEvent,,,,, EventUid,string,Recommended,RegistryEvent,,,,, EventUid,string,Recommended,UserManagement,,,,, EventUid,string,Recommended,WebSession,,,,, EventVendor,string,Mandatory,Common,,,,, ExternalUsersCount,int,Optional,AssetEntity,,,,, FileContentType,string,Optional,WebSession,,,,, FileExtension,string,Optional,AssetEntity,,,,, FileIsSignatureValid,bool,Optional,AssetEntity,,,,, FileMD5,string,Optional,AlertEvent,,,,, FileMD5,string,Optional,AssetEntity,,,,, FileMD5,string,Optional,WebSession,MD5,,,, FileName,string,Alias,FileEvent,,,TargetFileName,, FileName,string,Optional,AlertEvent,,,,, FileName,string,Optional,WebSession,,,,, FilePath,string,Alias,FileEvent,,,TargetFilePath,, FilePath,string,Optional,AlertEvent,,,,, FilePath,string,Optional,AssetEntity,,,,, FileSHA1,string,Optional,AlertEvent,,,,, FileSHA1,string,Optional,AssetEntity,,,,, FileSHA1,string,Optional,WebSession,SHA1,,,, FileSHA256,string,Optional,AlertEvent,,,,, FileSHA256,string,Optional,AssetEntity,,,,, FileSHA256,string,Optional,WebSession,SHA256,,,, FileSHA512,string,Optional,AssetEntity,,,,, FileSHA512,string,Optional,WebSession,SHA512,,,, FileSignatureDetails,string,Optional,AssetEntity,,,,, FileSize,long,Optional,AlertEvent,,,,, FileSize,long,Optional,AssetEntity,,,,, FileSize,long,Optional,WebSession,,,,, GroupId,string,Optional,UserManagement,,,,, GroupIdType,string,Optional,UserManagement,Enumerated,SID|UID|Simple,,, GroupName,string,Optional,UserManagement,,,,, GroupNameType,string,Optional,UserManagement,Enumerated,UPN|Windows|DN|Simple,,, GroupOriginalType,string,Optional,UserManagement,,,,, GroupType,string,Optional,UserManagement,Enumerated,Local Distribution|Local Security Enabled|Global Distribution|Global Security Enabled|Universal Distribution|Universal Security Enabled|Other,,, Hash,string,Alias,FileEvent,,,TargetFileMD5|TargetFileSHA1|TargetFileSHA256|TargetFileSHA512,, Hash,string,Alias,ProcessEvent,,,TargetProcessMD5|TargetProcessSHA1|TargetProcessSHA256|TargetProcessSHA256|TargetProcessIMPHASH,, Hash,string,Alias,WebSession,,,MD5|SHA1|SHA256|SHA512,, HashType,string,Conditional,FileEvent,Enumerated,MD5|SHA|SHA256|SHA512|IMPHASH,Hash,, HashType,string,Conditional,ProcessEvent,Enumerated,MD5|SHA|SHA256|SHA512|IMPHASH,Hash,, HashType,string,Conditional,WebSession,Enumerated,MD5|SHA1|SHA256|SHA512,Hash,, Hostname,string,Alias,AlertEvent,,,DvcHostname,, Hostname,string,Alias,DhcpEvent,Hostname,,DstHostname,, Hostname,string,Alias,Dns,Hostname,,SrcHostname,, Hostname,string,Alias,NetworkSession,Hostname,,DstHostname,, Hostname,string,Alias,UserManagement,Hostname,,DvcHostname,, Hostname,string,Alias,WebSession,Hostname,,DstHostname,, HttpContentFormat,string,Optional,WebSession,,,,, HttpContentType,string,Optional,WebSession,,,,, HttpCookie,string,Optional,WebSession,,,,, HttpHost,string,Optional,WebSession,,,,, HttpIsProxied,bool,Optional,WebSession,,,,, HttpReferrer,string,Optional,WebSession,,,,, HttpRequestBodyBytes,long,Optional,WebSession,,,,, HttpRequestCacheControl,string,Optional,WebSession,,,,, HttpRequestHeaderCount,int,Optional,WebSession,,,,, HttpRequestMethod,string,Recommended,WebSession,,,,, HttpRequestTime,int,Optional,WebSession,,,,, HttpRequestXff,string,Optional,WebSession,IP address,,,, HttpResponseBodyBytes,long,Optional,WebSession,,,,, HttpResponseCacheControl,string,Optional,WebSession,,,,, HttpResponseExpires,string,Optional,WebSession,,,,, HttpResponseHeaderCount,int,Optional,WebSession,,,,, HttpResponseTime,int,Optional,WebSession,,,,, HttpStatusCode,string,Alias,WebSession,Enumerated,,EventResultDetails,, HttpUserAgent,string,Optional,AuditEvent,,,,, HttpUserAgent,string,Optional,Authentication,,,,, HttpUserAgent,string,Optional,FileEvent,,,,, HttpUserAgent,string,Optional,UserManagement,,,,, HttpUserAgent,string,Optional,WebSession,,,,, HttpVersion,string,Optional,WebSession,,,,, IdentityDirectoryId,string,Mandatory,AssetEntity,,,,, IdentityDirectoryName,string,Optional,AssetEntity,,,,, IndicatorAssociation,string,Optional,AlertEvent,Enumerated,Associated|Targeted,,, IndicatorType,string,Recommended,AlertEvent,Enumerated,Ip|User|Url|Process|Registry|Host|Cloud Resource|Application|File|Email|Mailbox|Logon Session,,, InnerVlanId,string,Alias,NetworkSession,,,SrcVlanId,, InnerVlanId,string,Alias,WebSession,,,SrcVlanId,, InputTokensUsed,long,Optional,AgentEvent,,,,, InternalUsersCount,int,Optional,AssetEntity,,,,, IpAddr,string,Alias,AlertEvent,IP Address,,DvcIpAddr,, IpAddr,string,Alias,AuditEvent,IP Address,,SrcIpAddr,, IpAddr,string,Alias,Authentication,IP Address,,SrcIpAddr,, IpAddr,string,Alias,DhcpEvent,IP Address,,SrcIpAddr,, IpAddr,string,Alias,Dns,IP Address,,SrcIpAddr,, IpAddr,string,Alias,FileEvent,IP Address,,SrcIpAddr,, IpAddr,string,Alias,NetworkSession,IP Address,,SrcIpAddr,, IpAddr,string,Alias,UserManagement,IP address,,SrcIpAddr,, IpAddr,string,Alias,WebSession,IP Address,,SrcIpAddr,, LogonMethod,string,Optional,Authentication,Enumerated,Managed Identity|Service Principal|Username & Password|Multi factor authentication|Passwordless|PKI|PAM|Other,,, LogonProtocol,string,Optional,Authentication,,,,, LogonTarget,string,Optional,Authentication,,,,, ModelName,string,Optional,AgentEvent,,,,, ModelProviderName,string,Optional,AgentEvent,,,,, NetworkApplicationProtocol,string,Optional,FileEvent,Protocol,,,, NetworkApplicationProtocol,string,Optional,NetworkSession,,,,, NetworkApplicationProtocol,string,Optional,WebSession,,,,, NetworkBytes,long,Optional,NetworkSession,,,,, NetworkBytes,long,Optional,WebSession,,,,, NetworkConnectionHistory,string,Optional,NetworkSession,,,,, NetworkConnectionHistory,string,Optional,WebSession,,,,, NetworkDirection,string,Optional,NetworkSession,Enumerated,Inbound|Outbound|Listen|Unknown|Local|External|NA,,, NetworkDirection,string,Optional,WebSession,Enumerated,Inbound|Outbound|Listen|Unknown|Local|External|NA,,, NetworkDuration,int,Optional,NetworkSession,,,,, NetworkDuration,int,Optional,WebSession,,,,, NetworkIcmpCode,int,Optional,NetworkSession,,,,, NetworkIcmpCode,int,Optional,WebSession,,,,, NetworkIcmpType,string,Optional,NetworkSession,,,,, NetworkIcmpType,string,Optional,WebSession,,,,, NetworkPackets,long,Optional,NetworkSession,,,,, NetworkPackets,long,Optional,WebSession,,,,, NetworkProtocol,string,Optional,Dns,Enumerated,TCP|UDP,,, NetworkProtocol,string,Optional,NetworkSession,NetworkProtocol,,,, NetworkProtocol,string,Optional,WebSession,NetworkProtocol,,,, NetworkProtocolVersion,string,Optional,Dns,Enumerated,IPv4|IPv6,,, NetworkProtocolVersion,string,Optional,NetworkSession,Enumerated,IPv4|IPv6,,, NetworkProtocolVersion,string,Optional,WebSession,Enumerated,IPv4|IPv6,,, NetworkRuleName,string,Optional,NetworkSession,,,,, NetworkRuleNumber,int,Optional,NetworkSession,,,,, NetworkSessionId,string,Optional,NetworkSession,,,,, NetworkSessionId,string,Optional,WebSession,,,,, NewPropertyValue,string,Optional,UserManagement,,,,, NewValue,string,Recommended,AuditEvent,,,,, Object,string,Mandatory,AuditEvent,,,,, ObjectId,string,Optional,AuditEvent,,,,, ObjectType,string,Conditional,AuditEvent,Enumerated,Cloud Resource|Configuration Atom|Policy Rule|Event Log|Scheduled Task|Service|Directory Service Object|Other,Object,, OldValue,string,Optional,AuditEvent,,,,, Operation,string,Mandatory,AuditEvent,,,,, OriginalObjectType,string,Optional,AuditEvent,,,,, OriginalUserType,string,Optional,AlertEvent,,,,, OuterVlanId,string,Alias,NetworkSession,,,DstVlanId,, OuterVlanId,string,Alias,WebSession,,,DstVlanId,, OutputTokensUsed,long,Optional,AgentEvent,,,,, ParentProcessCreationTime,datetime,Optional,ProcessEvent,,,,, ParentProcessFileCompany,string,Optional,ProcessEvent,,,,, ParentProcessFileDescription,string,Optional,ProcessEvent,,,,, ParentProcessFileProduct,string,Optional,ProcessEvent,,,,, ParentProcessFileVersion,string,Optional,ProcessEvent,,,,, ParentProcessGuid,string,Optional,ProcessEvent,,,,, ParentProcessGuid,string,Optional,RegistryEvent,,,,, ParentProcessId,string,Mandatory,RegistryEvent,,,,, ParentProcessId,string,Recommended,ProcessEvent,,,,, ParentProcessIMPHASH,string,Optional,ProcessEvent,,,,, ParentProcessInjectedAddress,string,Optional,ProcessEvent,,,,, ParentProcessIntegrityLevel,string,Optional,ProcessEvent,,,,, ParentProcessIsHidden,bool,Optional,ProcessEvent,,,,, ParentProcessMD5,string,Optional,ProcessEvent,MD5,,,, ParentProcessName,string,Optional,ProcessEvent,,,,, ParentProcessName,string,Optional,RegistryEvent,,,,, ParentProcessSHA1,string,Optional,ProcessEvent,SHA1,,,, ParentProcessSHA256,string,Optional,ProcessEvent,SHA256,,,, ParentProcessSHA512,string,Optional,ProcessEvent,SHA512,,,, ParentProcessTokenElevation,string,Optional,ProcessEvent,,,,, PlatformTargetAgentDescription,string,Optional,AgentEvent,,,,, PlatformTargetAgentId,string,Optional,AgentEvent,,,,, PlatformTargetAgentName,string,Optional,AgentEvent,,,,, PlatformTargetOriginalAgentType,string,Optional,AgentEvent,,,,, PreviousPropertyValue,string,Optional,UserManagement,,,,, Process,string,Alias,Dns,,,SrcProcessName,, Process,string,Alias,FileEvent,,,ActingProcessName,, Process,string,Alias,NetworkSession,,,DstProcessName,, Process,string,Alias,ProcessEvent,,,TargetProcessName,, Process,string,Alias,RegistryEvent,,,ActingProcessName,, Process,string,Alias,WebSession,,,DstProcessName,, ProcessCommandLine,string,Optional,AlertEvent,,,,, ProcessFileCompany,string,Optional,AlertEvent,,,,, ProcessId,string,Optional,AlertEvent,,,,, ProcessName,string,Optional,AlertEvent,,,,, RegistryKey,string,Mandatory,RegistryEvent,,,,, RegistryKey,string,Optional,AlertEvent,,,,, RegistryPreviousKey,string,Recommended,RegistryEvent,,,,, RegistryPreviousValue,string,Recommended,RegistryEvent,,,,, RegistryPreviousValueData,string,Recommended,RegistryEvent,,,,, RegistryPreviousValueType,string,Recommended,RegistryEvent,,,,, RegistryValue,string,Optional,AlertEvent,,,,, RegistryValue,string,Recommended,RegistryEvent,,,,, RegistryValueData,string,Optional,AlertEvent,,,,, RegistryValueData,string,Recommended,RegistryEvent,,,,, RegistryValueType,string,Optional,AlertEvent,Enumerated,Reg_Expand_Sz,,, RegistryValueType,string,Recommended,RegistryEvent,,,,, RequestedIpAddr,string,Optional,DhcpEvent,IP Address,,,, Rule,string,Alias,AlertEvent,,,RuleName,, Rule,string,Alias,AuditEvent,,,RuleName,, Rule,string,Alias,Authentication,,,RuleName,, Rule,string,Alias,DhcpEvent,,,RuleName,, Rule,string,Alias,Dns,,,RuleName,, Rule,string,Alias,FileEvent,,,RuleName,, Rule,string,Alias,NetworkSession,,,RuleName,, Rule,string,Alias,ProcessEvent,,,RuleName,, Rule,string,Alias,RegistryEvent,,,RuleName,, Rule,string,Alias,UserManagement,,,RuleName,, Rule,string,Alias,WebSession,,,RuleName,, RuleDescription,string,Optional,AlertEvent,,,,, RuleName,string,Optional,AlertEvent,,,,, RuleName,string,Optional,AuditEvent,,,,, RuleName,string,Optional,Authentication,,,,, RuleName,string,Optional,DhcpEvent,,,,, RuleName,string,Optional,Dns,,,,, RuleName,string,Optional,FileEvent,,,,, RuleName,string,Optional,ProcessEvent,,,,, RuleName,string,Optional,RegistryEvent,,,,, RuleName,string,Optional,UserManagement,,,,, RuleName,string,Optional,WebSession,,,,, RuleNumber,int,Optional,AlertEvent,,,,, RuleNumber,int,Optional,AuditEvent,,,,, RuleNumber,int,Optional,Authentication,,,,, RuleNumber,int,Optional,DhcpEvent,,,,, RuleNumber,int,Optional,Dns,,,,, RuleNumber,int,Optional,FileEvent,,,,, RuleNumber,int,Optional,ProcessEvent,,,,, RuleNumber,int,Optional,RegistryEvent,,,,, RuleNumber,int,Optional,UserManagement,,,,, RuleNumber,int,Optional,WebSession,,,,, SessionId,string,Alias,DhcpEvent,,,DhcpSessionId,, SessionId,string,Alias,Dns,,,DnsSessionId,, SessionId,string,Alias,NetworkSession,,,NetworkSessionId,, SessionId,string,Alias,WebSession,,,NetworkSessionId,, SitePath,string,Optional,AssetEntity,,,,, SitePrimaryUri,string,Optional,AssetEntity,,,,, Src,string,Mandatory,Dns,,,,, Src,string,Optional,FileEvent,IP Address,,,, Src,string,Recommended,AuditEvent,,,,, Src,string,Recommended,Authentication,,,,, Src,string,Recommended,DhcpEvent,,,,, Src,string,Recommended,NetworkSession,,,,, Src,string,Recommended,UserManagement,,,,, Src,string,Recommended,WebSession,,,,, SrcAgentBlueprintId,string,Optional,AgentEvent,,,,, SrcAgentDescription,string,Optional,AgentEvent,,,,, SrcAgentId,string,Recommended,AgentEvent,,,,, SrcAgentName,string,Recommended,AgentEvent,,,,, SrcAgentOriginalType,string,Optional,AgentEvent,,,,, SrcAppId,string,Optional,NetworkSession,,,,, SrcAppId,string,Optional,WebSession,,,,, SrcAppName,string,Optional,NetworkSession,,,,, SrcAppName,string,Optional,WebSession,,,,, SrcAppType,string,Optional,NetworkSession,Enumerated,Process|Service|Resource|URL|SaaS application|Other,,, SrcAppType,string,Optional,WebSession,Enumerated,Process|Service|Resource|URL|SaaS application|Other,,, SrcBytes,long,Recommended,NetworkSession,,,,, SrcBytes,long,Recommended,WebSession,,,,, SrcDescription,string,Optional,AuditEvent,,,,, SrcDescription,string,Optional,Authentication,,,,, SrcDescription,string,Optional,DhcpEvent,,,,, SrcDescription,string,Optional,Dns,,,,, SrcDescription,string,Optional,FileEvent,,,,, SrcDescription,string,Optional,NetworkSession,,,,, SrcDescription,string,Optional,UserManagement,,,,, SrcDescription,string,Optional,WebSession,,,,, SrcDeviceType,string,Optional,AuditEvent,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,Authentication,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,DhcpEvent,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,Dns,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,FileEvent,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,NetworkSession,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,UserManagement,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDeviceType,string,Optional,WebSession,Enumerated,Computer|Mobile Device|IOT Device|Other,,, SrcDomain,string,Optional,AuditEvent,Domain,,,, SrcDomain,string,Optional,Authentication,Domain,,,, SrcDomain,string,Optional,FileEvent,Domain,,,, SrcDomain,string,Recommended,DhcpEvent,Domain,,,, SrcDomain,string,Recommended,Dns,Domain,,,, SrcDomain,string,Recommended,NetworkSession,Domain,,,, SrcDomain,string,Recommended,UserManagement,Domain,,,, SrcDomain,string,Recommended,WebSession,Domain,,,, SrcDomainType,string,Conditional,AuditEvent,Enumerated,Windows|FQDN,SrcDomain,, SrcDomainType,string,Conditional,Authentication,Enumerated,Windows|FQDN|ResourceGroup,SrcDomain,, SrcDomainType,string,Conditional,DhcpEvent,Enumerated,Windows|FQDN,SrcDomain,, SrcDomainType,string,Conditional,Dns,Enumerated,Windows|FQDN|ResourceGroup,SrcDomain,, SrcDomainType,string,Conditional,FileEvent,Enumerated,Windows|FQDN,SrcDomain,, SrcDomainType,string,Conditional,NetworkSession,Enumerated,Windows|FQDN|ResourceGroup,SrcDomain,, SrcDomainType,string,Conditional,WebSession,Enumerated,Windows|FQDN|ResourceGroup,SrcDomain,, SrcDomainType,string,Recommended,UserManagement,Enumerated,Windows|FQDN,,, SrcDvcId,string,Optional,AuditEvent,,,,, SrcDvcId,string,Optional,Authentication,,,,, SrcDvcId,string,Optional,DhcpEvent,,,,, SrcDvcId,string,Optional,Dns,,,,, SrcDvcId,string,Optional,FileEvent,,,,, SrcDvcId,string,Optional,NetworkSession,,,,, SrcDvcId,string,Optional,UserManagement,,,,, SrcDvcId,string,Optional,WebSession,,,,, SrcDvcIdType,string,Conditional,AuditEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,Authentication,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,DhcpEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,Dns,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,FileEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,NetworkSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,UserManagement,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcIdType,string,Conditional,WebSession,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|ForcepointId|AppGateId|Other,SrcDvcId,, SrcDvcOs,string,Optional,Authentication,,,,, SrcDvcScope,string,Optional,AuditEvent,,,,, SrcDvcScope,string,Optional,Authentication,,,,, SrcDvcScope,string,Optional,DhcpEvent,,,,, SrcDvcScope,string,Optional,Dns,,,,, SrcDvcScope,string,Optional,FileEvent,,,,, SrcDvcScope,string,Optional,NetworkSession,,,,, SrcDvcScope,string,Optional,UserManagement,,,,, SrcDvcScope,string,Optional,WebSession,,,,, SrcDvcScopeId,string,Optional,AuditEvent,,,,, SrcDvcScopeId,string,Optional,Authentication,,,,, SrcDvcScopeId,string,Optional,DhcpEvent,,,,, SrcDvcScopeId,string,Optional,Dns,,,,, SrcDvcScopeId,string,Optional,FileEvent,,,,, SrcDvcScopeId,string,Optional,NetworkSession,,,,, SrcDvcScopeId,string,Optional,UserManagement,,,,, SrcDvcScopeId,string,Optional,WebSession,,,,, SrcFileCreationTime,datetime,Optional,FileEvent,,,,, SrcFileDirectory,string,Optional,FileEvent,,,,, SrcFileExtension,string,Optional,FileEvent,,,,, SrcFileMD5,string,Optional,FileEvent,MD5,,,, SrcFileMimeType,string,Optional,FileEvent,,,,, SrcFileName,string,Recommended,FileEvent,,,,, SrcFilePath,string,Recommended,FileEvent,,,,, SrcFilePathType,string,Recommended,FileEvent,Enumerated,Windows Local|Windows Share|Unix|URL,,, SrcFileSHA1,string,Optional,FileEvent,SHA1,,,, SrcFileSHA256,string,Optional,FileEvent,SHA256,,,, SrcFileSHA512,string,Optional,FileEvent,SHA512,,,, SrcFileSize,long,Optional,FileEvent,,,,, SrcFQDN,string,Optional,AgentEvent,FQDN,,,, SrcFQDN,string,Optional,AuditEvent,FQDN,,,, SrcFQDN,string,Optional,Authentication,FQDN,,,, SrcFQDN,string,Optional,DhcpEvent,FQDN,,,, SrcFQDN,string,Optional,Dns,FQDN,,,, SrcFQDN,string,Optional,FileEvent,FQDN,,,, SrcFQDN,string,Optional,NetworkSession,FQDN,,,, SrcFQDN,string,Optional,UserManagement,FQDN,,,, SrcFQDN,string,Optional,WebSession,FQDN,,,, SrcGeoCity,string,Optional,AuditEvent,,,,, SrcGeoCity,string,Optional,Authentication,,,,, SrcGeoCity,string,Optional,DhcpEvent,,,,, SrcGeoCity,string,Optional,Dns,,,,, SrcGeoCity,string,Optional,FileEvent,,,,, SrcGeoCity,string,Optional,NetworkSession,,,,, SrcGeoCity,string,Optional,UserManagement,,,,, SrcGeoCity,string,Optional,WebSession,,,,, SrcGeoCountry,string,Optional,AuditEvent,,,,, SrcGeoCountry,string,Optional,Authentication,,,,, SrcGeoCountry,string,Optional,DhcpEvent,,,,, SrcGeoCountry,string,Optional,Dns,,,,, SrcGeoCountry,string,Optional,FileEvent,,,,, SrcGeoCountry,string,Optional,NetworkSession,,,,, SrcGeoCountry,string,Optional,UserManagement,,,,, SrcGeoCountry,string,Optional,WebSession,,,,, SrcGeoLatitude,real,Optional,AuditEvent,,,,, SrcGeoLatitude,real,Optional,Authentication,,,,, SrcGeoLatitude,real,Optional,DhcpEvent,,,,, SrcGeoLatitude,real,Optional,Dns,,,,, SrcGeoLatitude,real,Optional,FileEvent,,,,, SrcGeoLatitude,real,Optional,NetworkSession,,,,, SrcGeoLatitude,real,Optional,UserManagement,,,,, SrcGeoLatitude,real,Optional,WebSession,,,,, SrcGeoLongitude,real,Optional,AuditEvent,,,,, SrcGeoLongitude,real,Optional,Authentication,,,,, SrcGeoLongitude,real,Optional,DhcpEvent,,,,, SrcGeoLongitude,real,Optional,Dns,,,,, SrcGeoLongitude,real,Optional,FileEvent,,,,, SrcGeoLongitude,real,Optional,NetworkSession,,,,, SrcGeoLongitude,real,Optional,UserManagement,,,,, SrcGeoLongitude,real,Optional,WebSession,,,,, SrcGeoRegion,string,Optional,AuditEvent,,,,, SrcGeoRegion,string,Optional,Authentication,,,,, SrcGeoRegion,string,Optional,DhcpEvent,,,,, SrcGeoRegion,string,Optional,Dns,,,,, SrcGeoRegion,string,Optional,FileEvent,,,,, SrcGeoRegion,string,Optional,NetworkSession,,,,, SrcGeoRegion,string,Optional,UserManagement,,,,, SrcGeoRegion,string,Optional,WebSession,,,,, SrcHostname,string,Mandatory,DhcpEvent,Hostname,,,, SrcHostname,string,Optional,AuditEvent,Hostname,,,, SrcHostname,string,Optional,Authentication,Hostname,,,, SrcHostname,string,Optional,FileEvent,Hostname,,,, SrcHostname,string,Recommended,Dns,Hostname,,,, SrcHostname,string,Recommended,NetworkSession,Hostname,,,, SrcHostname,string,Recommended,UserManagement,,,,, SrcHostname,string,Recommended,WebSession,Hostname,,,, SrcInterfaceGuid,string,Optional,NetworkSession,GUID,,,, SrcInterfaceGuid,string,Optional,WebSession,GUID,,,, SrcInterfaceName,string,Optional,NetworkSession,,,,, SrcInterfaceName,string,Optional,WebSession,,,,, SrcIpAddr,string,Mandatory,DhcpEvent,IP Address,,,, SrcIpAddr,string,Optional,AgentEvent,IP Address,,,, SrcIpAddr,string,Recommended,AuditEvent,IP Address,,,, SrcIpAddr,string,Recommended,Authentication,IP Address,,,, SrcIpAddr,string,Recommended,Dns,IP Address,,,, SrcIpAddr,string,Recommended,FileEvent,IP Address,,,, SrcIpAddr,string,Recommended,NetworkSession,IP Address,,,, SrcIpAddr,string,Recommended,UserManagement,IP Address,,,, SrcIpAddr,string,Recommended,WebSession,IP Address,,,, SrcIsp,string,Optional,Authentication,,,,, SrcMacAddr,string,Mandatory,DhcpEvent,MAC Address,,,, SrcMacAddr,string,Optional,NetworkSession,MAC Address,,,, SrcMacAddr,string,Optional,UserManagement,MAC Address,,,, SrcMacAddr,string,Optional,WebSession,MAC Address,,,, SrcNatIpAddr,string,Optional,NetworkSession,IP Address,,,, SrcNatIpAddr,string,Optional,WebSession,IP Address,,,, SrcNatPortNumber,int,Optional,NetworkSession,,,,, SrcNatPortNumber,int,Optional,WebSession,,,,, SrcOriginalRiskLevel,string,Optional,AuditEvent,,,,, SrcOriginalRiskLevel,string,Optional,Authentication,,,,, SrcOriginalRiskLevel,string,Optional,DhcpEvent,,,,, SrcOriginalRiskLevel,string,Optional,Dns,,,,, SrcOriginalRiskLevel,string,Optional,UserManagement,,,,, SrcOriginalUserType,string,Optional,DhcpEvent,,,,, SrcOriginalUserType,string,Optional,Dns,,,,, SrcOriginalUserType,string,Optional,NetworkSession,,,,, SrcOriginalUserType,string,Optional,WebSession,,,,, SrcPackets,long,Optional,NetworkSession,,,,, SrcPackets,long,Optional,WebSession,,,,, SrcPortNumber,int,Optional,AgentEvent,,,,, SrcPortNumber,int,Optional,AuditEvent,,,,, SrcPortNumber,int,Optional,Authentication,,,,, SrcPortNumber,int,Optional,DhcpEvent,,,,, SrcPortNumber,int,Optional,Dns,,,,, SrcPortNumber,int,Optional,FileEvent,,,,, SrcPortNumber,int,Optional,NetworkSession,,,,, SrcPortNumber,int,Optional,UserManagement,,,,, SrcPortNumber,int,Optional,WebSession,,,,, SrcProcessGuid,string,Optional,Dns,GUID,,,, SrcProcessGuid,string,Optional,NetworkSession,,,,, SrcProcessGuid,string,Optional,WebSession,,,,, SrcProcessId,string,Optional,Dns,,,,, SrcProcessId,string,Optional,NetworkSession,,,,, SrcProcessId,string,Optional,WebSession,,,,, SrcProcessName,string,Optional,Dns,,,,, SrcProcessName,string,Optional,NetworkSession,,,,, SrcProcessName,string,Optional,WebSession,,,,, SrcRiskLevel,int,Optional,AuditEvent,,,,, SrcRiskLevel,int,Optional,Authentication,,,,, SrcRiskLevel,int,Optional,DhcpEvent,,,,, SrcRiskLevel,int,Optional,Dns,,,,, SrcRiskLevel,int,Optional,UserManagement,,,,, SrcUserAadId,string,Optional,Dns,,,,, SrcUserAWSId,string,Optional,Dns,,,,, SrcUserId,string,Optional,DhcpEvent,,,,, SrcUserId,string,Optional,Dns,,,,, SrcUserId,string,Optional,NetworkSession,,,,, SrcUserId,string,Optional,WebSession,,,,, SrcUserIdType,string,Conditional,DhcpEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,SrcUserId,, SrcUserIdType,string,Conditional,Dns,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,SrcUserId,, SrcUserIdType,string,Conditional,NetworkSession,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,SrcUserId,, SrcUserIdType,string,Conditional,WebSession,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,SrcUserId,, SrcUsername,string,Optional,DhcpEvent,,,,, SrcUsername,string,Optional,Dns,,,,, SrcUsername,string,Optional,NetworkSession,,,,, SrcUsername,string,Optional,WebSession,,,,, SrcUsernameType,string,Conditional,DhcpEvent,Enumerated,UPN|Windows|DN|Simple,SrcUsername,, SrcUsernameType,string,Conditional,Dns,Enumerated,UPN|Windows|DN|Simple,SrcUsername,, SrcUsernameType,string,Conditional,NetworkSession,Enumerated,UPN|Windows|DN|Simple,SrcUsername,, SrcUsernameType,string,Conditional,WebSession,Enumerated,UPN|Windows|DN|Simple,SrcUsername,, SrcUserOktaId,string,Optional,Dns,,,,, SrcUserScope,string,Optional,DhcpEvent,,,,, SrcUserScope,string,Optional,Dns,,,,, SrcUserScope,string,Optional,NetworkSession,,,,, SrcUserScope,string,Optional,WebSession,,,,, SrcUserScopeId,string,Optional,DhcpEvent,,,,, SrcUserScopeId,string,Optional,Dns,,,,, SrcUserScopeId,string,Optional,NetworkSession,,,,, SrcUserScopeId,string,Optional,WebSession,,,,, SrcUserSessionId,string,Optional,DhcpEvent,,,,, SrcUserSessionId,string,Optional,Dns,,,,, SrcUserSid,string,Optional,Dns,,,,, SrcUserType,string,Optional,DhcpEvent,Enumerated,Regular|Machine|Admin|System|Application|Service Principal|Other,,, SrcUserType,string,Optional,Dns,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, SrcUserType,string,Optional,NetworkSession,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, SrcUserType,string,Optional,WebSession,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, SrcVlanId,string,Optional,NetworkSession,,,,, SrcVlanId,string,Optional,WebSession,,,,, SrcZone,string,Optional,NetworkSession,,,,, SrcZone,string,Optional,WebSession,,,,, TargetAgentBlueprintId,string,Optional,AgentEvent,,,,, TargetAgentDescription,string,Optional,AgentEvent,,,,, TargetAgentId,string,Optional,AgentEvent,,,,, TargetAgentName,string,Optional,AgentEvent,,,,, TargetAgentOriginalType,string,Optional,AgentEvent,,,,, TargetAgentUserId,string,Optional,AgentEvent,,,,, TargetAgentUsername,string,Optional,AgentEvent,,,,, TargetAppId,string,Optional,AuditEvent,,,,, TargetAppId,string,Optional,Authentication,,,,, TargetAppId,string,Optional,FileEvent,,,,, TargetAppName,string,Optional,AuditEvent,,,,, TargetAppName,string,Optional,Authentication,,,,, TargetAppName,string,Optional,FileEvent,,,,, TargetAppType,string,Conditional,AuditEvent,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other,TargetAppName,, TargetAppType,string,Conditional,Authentication,Enumerated,Process|Service|Resource|URL|SaaS application|Other,TargetAppName,, TargetAppType,string,Conditional,FileEvent,Enumerated,Process|Service|Resource|URL|SaaS application|Other,TargetAppName,, TargetDescription,string,Optional,AuditEvent,,,,, TargetDescription,string,Optional,Authentication,,,,, TargetDeviceType,string,Optional,AuditEvent,Enumerated,Computer|Mobile Device|IOT Device|Other,,, TargetDeviceType,string,Optional,Authentication,Enumerated,Computer|Mobile Device|IOT Device|Other,,, TargetDNUsername,string,Optional,Authentication,,,,, TargetDNUsername,string,Optional,ProcessEvent,,,,, TargetDNUsername,string,Optional,UserManagement,,,,, TargetDomain,string,Optional,AuditEvent,Domain,,,, TargetDomain,string,Recommended,Authentication,Domain,,,, TargetDomainType,string,Conditional,AuditEvent,Enumerated,Windows|FQDN,TargetDomain,, TargetDomainType,string,Conditional,Authentication,Enumerated,Windows|FQDN|ResourceGroup,TargetDomain,, TargetDvcId,string,Optional,AuditEvent,,,,, TargetDvcId,string,Optional,Authentication,,,,, TargetDvcIdType,string,Conditional,AuditEvent,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|Other,TargetDvcId,, TargetDvcIdType,string,Conditional,Authentication,Enumerated,AzureResourceId|MDEid|MD4IoTid|VMConnectionId|AwsVpcId|VectraId|AppGateId|Other,TargetDvcId,, TargetDvcOs,string,Optional,AuditEvent,,,,, TargetDvcOs,string,Optional,Authentication,,,,, TargetDvcScope,string,Optional,AuditEvent,,,,, TargetDvcScope,string,Optional,Authentication,,,,, TargetDvcScopeId,string,Optional,AuditEvent,,,,, TargetDvcScopeId,string,Optional,Authentication,,,,, TargetFileCreationTime,datetime,Optional,FileEvent,,,,, TargetFileDirectory,string,Optional,FileEvent,,,,, TargetFileExtension,string,Optional,FileEvent,,,,, TargetFileMD5,string,Optional,FileEvent,MD5,,,, TargetFileMimeType,string,Optional,FileEvent,,,,, TargetFileName,string,Recommended,FileEvent,,,,, TargetFilePath,string,Mandatory,FileEvent,,,,, TargetFilePathType,string,Mandatory,FileEvent,Enumerated,Windows Local|Windows Share|Unix|URL|FileNameOnly,,, TargetFileSHA1,string,Optional,FileEvent,SHA1,,,, TargetFileSHA256,string,Optional,FileEvent,SHA256,,,, TargetFileSHA512,string,Optional,FileEvent,SHA512,,,, TargetFileSize,long,Optional,FileEvent,,,,, TargetFQDN,string,Optional,AuditEvent,FQDN,,,, TargetFQDN,string,Optional,Authentication,FQDN,,,, TargetGeoCity,string,Optional,AuditEvent,,,,, TargetGeoCity,string,Optional,Authentication,,,,, TargetGeoCountry,string,Optional,AuditEvent,,,,, TargetGeoCountry,string,Optional,Authentication,,,,, TargetGeoLatitude,real,Optional,AuditEvent,,,,, TargetGeoLatitude,real,Optional,Authentication,,,,, TargetGeoLongitude,real,Optional,AuditEvent,,,,, TargetGeoLongitude,real,Optional,Authentication,,,,, TargetGeoRegion,string,Optional,AuditEvent,,,,, TargetGeoRegion,string,Optional,Authentication,,,,, TargetHostname,string,Recommended,AuditEvent,Hostname,,,, TargetHostname,string,Recommended,Authentication,Hostname,,,, TargetIpAddr,string,Optional,Authentication,IP Address,,,, TargetIpAddr,string,Recommended,AuditEvent,IP Address,,,, TargetOriginalAppType,string,Optional,AuditEvent,,,,, TargetOriginalAppType,string,Optional,Authentication,,,,, TargetOriginalAppType,string,Optional,FileEvent,,,,, TargetOriginalRiskLevel,string,Optional,AuditEvent,,,,, TargetOriginalRiskLevel,string,Optional,Authentication,,,,, TargetOriginalUserType,string,Optional,Authentication,,,,, TargetOriginalUserType,string,Optional,ProcessEvent,,,,, TargetOriginalUserType,string,Optional,UserManagement,,,,, TargetPortNumber,int,Optional,AuditEvent,,,,, TargetPortNumber,int,Optional,Authentication,,,,, TargetProcessCommandLine,string,Mandatory,ProcessEvent,,,,, TargetProcessCreationTime,datetime,Recommended,ProcessEvent,,,,, TargetProcessCurrentDirectory,string,Optional,ProcessEvent,,,,, TargetProcessFileCompany,string,Optional,ProcessEvent,,,,, TargetProcessFileDescription,string,Optional,ProcessEvent,,,,, TargetProcessFileInternalName,string,Optional,ProcessEvent,,,,, TargetProcessFilename,string,Optional,ProcessEvent,,,,, TargetProcessFileOriginalName,string,Optional,ProcessEvent,,,,, TargetProcessFileProduct,string,Optional,ProcessEvent,,,,, TargetProcessFileSize,long,Optional,ProcessEvent,,,,, TargetProcessFileVersion,string,Optional,ProcessEvent,,,,, TargetProcessGuid,string,Optional,ProcessEvent,GUID,,,, TargetProcessId,string,Mandatory,ProcessEvent,,,,, TargetProcessIMPHASH,string,Optional,ProcessEvent,,,,, TargetProcessInjectedAddress,string,Optional,ProcessEvent,,,,, TargetProcessIntegrityLevel,string,Optional,ProcessEvent,,,,, TargetProcessIsHidden,bool,Optional,ProcessEvent,,,,, TargetProcessMD5,string,Optional,ProcessEvent,MD5,,,, TargetProcessName,string,Mandatory,ProcessEvent,,,,, TargetProcessSHA1,string,Optional,ProcessEvent,SHA1,,,, TargetProcessSHA256,string,Optional,ProcessEvent,SHA256,,,, TargetProcessSHA512,string,Optional,ProcessEvent,SHA512,,,, TargetProcessStatusCode,string,Optional,ProcessEvent,,,,, TargetProcessTokenElevation,string,Optional,ProcessEvent,,,,, TargetRiskLevel,int,Optional,AuditEvent,,,,, TargetRiskLevel,int,Optional,Authentication,,,,, TargetSessionId,string,Optional,Authentication,,,,, TargetSimpleUsername,string,Optional,Authentication,,,,, TargetSimpleUsername,string,Optional,ProcessEvent,,,,, TargetSimpleUsername,string,Optional,UserManagement,,,,, TargetUrl,string,Optional,AuditEvent,URL,,,, TargetUrl,string,Optional,Authentication,URL,,,, TargetUrl,string,Optional,FileEvent,URL,,,, TargetUserAadId,string,Optional,Authentication,,,,, TargetUserAadId,string,Optional,ProcessEvent,,,,, TargetUserAadId,string,Optional,UserManagement,,,,, TargetUserAWSId,string,Optional,Authentication,,,,, TargetUserAWSId,string,Optional,ProcessEvent,,,,, TargetUserAWSId,string,Optional,UserManagement,,,,, TargetUserId,string,Optional,Authentication,,,,, TargetUserId,string,Optional,UserManagement,,,,, TargetUserId,string,Recommended,ProcessEvent,,,,, TargetUserIdType,string,Conditional,Authentication,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|GWorkspaceProfileID|Other,TargetUserId,, TargetUserIdType,string,Conditional,ProcessEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,TargetUserId,, TargetUserIdType,string,Conditional,UserManagement,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|AWSIAMUserId|AWSIAMRoleId|Other,TargetUserId,, TargetUsername,string,Mandatory,ProcessEvent,,,,, TargetUsername,string,Optional,Authentication,,,,, TargetUsername,string,Optional,UserManagement,,,,, TargetUsernameType,string,Conditional,Authentication,Enumerated,UPN|Windows|DN|Simple,TargetUsername,, TargetUsernameType,string,Conditional,ProcessEvent,Enumerated,UPN|Windows|DN|Simple,TargetUsername,, TargetUsernameType,string,Conditional,UserManagement,Enumerated,UPN|Windows|DN|Simple,TargetUsername,, TargetUserOktaId,string,Optional,Authentication,,,,, TargetUserOktaId,string,Optional,ProcessEvent,,,,, TargetUserOktaId,string,Optional,UserManagement,,,,, TargetUserPuid,string,Optional,Authentication,,,,, TargetUserPuid,string,Optional,ProcessEvent,,,,, TargetUserPuid,string,Optional,UserManagement,,,,, TargetUserScope,string,Optional,Authentication,,,,, TargetUserScope,string,Optional,ProcessEvent,,,,, TargetUserScope,string,Optional,UserManagement,,,,, TargetUserScopeId,string,Optional,Authentication,,,,, TargetUserScopeId,string,Optional,ProcessEvent,,,,, TargetUserScopeId,string,Optional,UserManagement,,,,, TargetUserSessionGuid,string,Optional,ProcessEvent,,,,, TargetUserSessionId,string,Optional,ProcessEvent,,,,, TargetUserSessionId,string,Optional,UserManagement,,,,, TargetUserSid,string,Optional,Authentication,,,,, TargetUserSid,string,Optional,ProcessEvent,,,,, TargetUserSid,string,Optional,UserManagement,,,,, TargetUserType,string,Optional,Authentication,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, TargetUserType,string,Optional,ProcessEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other,,, TargetUserType,string,Optional,UserManagement,Enumerated,Regular|Machine|Admin|System|Application|Service Principal|Other,,, TargetUserUid,string,Optional,Authentication,,,,, TargetUserUid,string,Optional,ProcessEvent,,,,, TargetUserUid,string,Optional,UserManagement,,,,, TargetUserUpn,string,Optional,Authentication,,,,, TargetUserUpn,string,Optional,ProcessEvent,,,,, TargetUserUpn,string,Optional,UserManagement,,,,, TargetWindowsUsername,string,Optional,Authentication,,,,, TargetWindowsUsername,string,Optional,ProcessEvent,,,,, TargetWindowsUsername,string,Optional,UserManagement,,,,, TcpFlagsAck,bool,Optional,NetworkSession,,,,, TcpFlagsAck,bool,Optional,WebSession,,,,, TcpFlagsCwr,bool,Optional,NetworkSession,,,,, TcpFlagsCwr,bool,Optional,WebSession,,,,, TcpFlagsEce,bool,Optional,NetworkSession,,,,, TcpFlagsEce,bool,Optional,WebSession,,,,, TcpFlagsFin,bool,Optional,NetworkSession,,,,, TcpFlagsFin,bool,Optional,WebSession,,,,, TcpFlagsNs,bool,Optional,NetworkSession,,,,, TcpFlagsNs,bool,Optional,WebSession,,,,, TcpFlagsPsh,bool,Optional,NetworkSession,,,,, TcpFlagsPsh,bool,Optional,WebSession,,,,, TcpFlagsRst,bool,Optional,NetworkSession,,,,, TcpFlagsRst,bool,Optional,WebSession,,,,, TcpFlagsSyn,bool,Optional,NetworkSession,,,,, TcpFlagsSyn,bool,Optional,WebSession,,,,, TcpFlagsUrg,bool,Optional,NetworkSession,,,,, TcpFlagsUrg,bool,Optional,WebSession,,,,, ThreatCategory,string,Optional,AuditEvent,,,,, ThreatCategory,string,Optional,Authentication,,,,, ThreatCategory,string,Optional,DhcpEvent,,,,, ThreatCategory,string,Optional,Dns,,,,, ThreatCategory,string,Optional,FileEvent,,,,, ThreatCategory,string,Optional,NetworkSession,,,,, ThreatCategory,string,Optional,ProcessEvent,,,,, ThreatCategory,string,Optional,RegistryEvent,,,,, ThreatCategory,string,Optional,UserManagement,,,,, ThreatCategory,string,Optional,WebSession,,,,, ThreatCategory,string,Recommended,AlertEvent,Enumerated,Malware|Ransomeware|Trojan|Virus|Worm|Worm|Adware|Spyware|Rootkit|Cryptominer|Phishing|Spam|MaliciousUrl|Spoofing|Security Policy Violation|Unknown,,, ThreatConfidence,int,Optional,AlertEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,AuditEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,Authentication,ConfidenceLevel,,,, ThreatConfidence,int,Optional,DhcpEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,Dns,ConfidenceLevel,,,, ThreatConfidence,int,Optional,FileEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,NetworkSession,ConfidenceLevel,,,, ThreatConfidence,int,Optional,ProcessEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,RegistryEvent,ConfidenceLevel,,,, ThreatConfidence,int,Optional,UserManagement,ConfidenceLevel,,,, ThreatConfidence,int,Optional,WebSession,ConfidenceLevel,,,, ThreatField,string,Conditional,AuditEvent,Enumerated,SrcIpAddr|TargetIpAddr,ThreatIpAddr,, ThreatField,string,Conditional,Authentication,Enumerated,SrcIpAddr|TargetIpAddr,ThreatIpAddr,, ThreatField,string,Conditional,FileEvent,Enumerated,SrcIpAddr|TargetIpAddr,ThreatFilePath,, ThreatField,string,Conditional,NetworkSession,Enumerated,SrcIpAddr|TargetIpAddr,ThreatIpAddr,, ThreatField,string,Optional,Dns,Enumerated,SrcIpAddr|DstIpAddr|Domain|DnsResponseName,,, ThreatField,string,Optional,ProcessEvent,,,,, ThreatField,string,Optional,RegistryEvent,,,,, ThreatField,string,Optional,UserManagement,,,,, ThreatField,string,Optional,WebSession,Enumerated,SrcIpAddr|TargetIpAddr,ThreatIpAddr,, ThreatFilePath,string,Optional,FileEvent,string,,,, ThreatFirstReportedTime,datetime,Optional,AlertEvent,,,,, ThreatFirstReportedTime,datetime,Optional,AuditEvent,,,,, ThreatFirstReportedTime,datetime,Optional,Authentication,,,,, ThreatFirstReportedTime,datetime,Optional,DhcpEvent,,,,, ThreatFirstReportedTime,datetime,Optional,Dns,,,,, ThreatFirstReportedTime,datetime,Optional,FileEvent,,,,, ThreatFirstReportedTime,datetime,Optional,NetworkSession,,,,, ThreatFirstReportedTime,datetime,Optional,ProcessEvent,,,,, ThreatFirstReportedTime,datetime,Optional,RegistryEvent,,,,, ThreatFirstReportedTime,datetime,Optional,UserManagement,,,,, ThreatFirstReportedTime,datetime,Optional,WebSession,,,,, ThreatId,string,Optional,AlertEvent,,,,, ThreatId,string,Optional,AuditEvent,,,,, ThreatId,string,Optional,Authentication,,,,, ThreatId,string,Optional,DhcpEvent,,,,, ThreatId,string,Optional,Dns,,,,, ThreatId,string,Optional,FileEvent,,,,, ThreatId,string,Optional,NetworkSession,,,,, ThreatId,string,Optional,ProcessEvent,,,,, ThreatId,string,Optional,RegistryEvent,,,,, ThreatId,string,Optional,UserManagement,,,,, ThreatId,string,Optional,WebSession,,,,, ThreatIpAddr,string,Optional,AuditEvent,IP Address,,,, ThreatIpAddr,string,Optional,Authentication,IP Address,,,, ThreatIpAddr,string,Optional,Dns,IP Address,,,, ThreatIpAddr,string,Optional,NetworkSession,IP Address,,,, ThreatIpAddr,string,Optional,WebSession,IP Address,,,, ThreatIsActive,bool,Optional,AlertEvent,,,,, ThreatIsActive,bool,Optional,AuditEvent,,,,, ThreatIsActive,bool,Optional,Authentication,,,,, ThreatIsActive,bool,Optional,DhcpEvent,,,,, ThreatIsActive,bool,Optional,Dns,,,,, ThreatIsActive,bool,Optional,FileEvent,,,,, ThreatIsActive,bool,Optional,NetworkSession,,,,, ThreatIsActive,bool,Optional,ProcessEvent,,,,, ThreatIsActive,bool,Optional,RegistryEvent,,,,, ThreatIsActive,bool,Optional,UserManagement,,,,, ThreatIsActive,bool,Optional,WebSession,,,,, ThreatLastReportedTime,datetime,Optional,AlertEvent,,,,, ThreatLastReportedTime,datetime,Optional,AuditEvent,,,,, ThreatLastReportedTime,datetime,Optional,Authentication,,,,, ThreatLastReportedTime,datetime,Optional,DhcpEvent,,,,, ThreatLastReportedTime,datetime,Optional,Dns,,,,, ThreatLastReportedTime,datetime,Optional,FileEvent,,,,, ThreatLastReportedTime,datetime,Optional,NetworkSession,,,,, ThreatLastReportedTime,datetime,Optional,ProcessEvent,,,,, ThreatLastReportedTime,datetime,Optional,RegistryEvent,,,,, ThreatLastReportedTime,datetime,Optional,UserManagement,,,,, ThreatLastReportedTime,datetime,Optional,WebSession,,,,, ThreatName,string,Optional,AlertEvent,,,,, ThreatName,string,Optional,AuditEvent,,,,, ThreatName,string,Optional,Authentication,,,,, ThreatName,string,Optional,DhcpEvent,,,,, ThreatName,string,Optional,Dns,,,,, ThreatName,string,Optional,FileEvent,,,,, ThreatName,string,Optional,NetworkSession,,,,, ThreatName,string,Optional,ProcessEvent,,,,, ThreatName,string,Optional,RegistryEvent,,,,, ThreatName,string,Optional,UserManagement,,,,, ThreatName,string,Optional,WebSession,,,,, ThreatOriginalCategory,string,Optional,AlertEvent,,,,, ThreatOriginalConfidence,string,Optional,AlertEvent,,,,, ThreatOriginalConfidence,string,Optional,AuditEvent,,,,, ThreatOriginalConfidence,string,Optional,Authentication,,,,, ThreatOriginalConfidence,string,Optional,DhcpEvent,,,,, ThreatOriginalConfidence,string,Optional,Dns,,,,, ThreatOriginalConfidence,string,Optional,FileEvent,,,,, ThreatOriginalConfidence,string,Optional,NetworkSession,,,,, ThreatOriginalConfidence,string,Optional,ProcessEvent,,,,, ThreatOriginalConfidence,string,Optional,RegistryEvent,,,,, ThreatOriginalConfidence,string,Optional,UserManagement,,,,, ThreatOriginalConfidence,string,Optional,WebSession,,,,, ThreatOriginalRiskLevel,string,Optional,AlertEvent,,,,, ThreatOriginalRiskLevel,string,Optional,AuditEvent,,,,, ThreatOriginalRiskLevel,string,Optional,Authentication,,,,, ThreatOriginalRiskLevel,string,Optional,DhcpEvent,,,,, ThreatOriginalRiskLevel,string,Optional,Dns,,,,, ThreatOriginalRiskLevel,string,Optional,FileEvent,,,,, ThreatOriginalRiskLevel,string,Optional,NetworkSession,,,,, ThreatOriginalRiskLevel,string,Optional,ProcessEvent,,,,, ThreatOriginalRiskLevel,string,Optional,RegistryEvent,,,,, ThreatOriginalRiskLevel,string,Optional,UserManagement,,,,, ThreatOriginalRiskLevel,string,Optional,WebSession,,,,, ThreatRiskLevel,int,Optional,AlertEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,AuditEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,Authentication,RiskLevel,,,, ThreatRiskLevel,int,Optional,DhcpEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,Dns,RiskLevel,,,, ThreatRiskLevel,int,Optional,FileEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,NetworkSession,RiskLevel,,,, ThreatRiskLevel,int,Optional,ProcessEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,RegistryEvent,RiskLevel,,,, ThreatRiskLevel,int,Optional,UserManagement,RiskLevel,,,, ThreatRiskLevel,int,Optional,WebSession,RiskLevel,,,, TimeGenerated,datetime,Mandatory,AlertEvent,,,,, TimeGenerated,datetime,Mandatory,AuditEvent,,,,, TimeGenerated,datetime,Mandatory,Authentication,,,,, TimeGenerated,datetime,Mandatory,Common,,,,, TimeGenerated,datetime,Mandatory,DhcpEvent,,,,, TimeGenerated,datetime,Mandatory,Dns,,,,, TimeGenerated,datetime,Mandatory,FileEvent,,,,, TimeGenerated,datetime,Mandatory,NetworkSession,,,,, TimeGenerated,datetime,Mandatory,ProcessEvent,,,,, TimeGenerated,datetime,Mandatory,RegistryEvent,,,,, TimeGenerated,datetime,Mandatory,UserManagement,,,,, TimeGenerated,datetime,Mandatory,WebSession,,,,, ToolDescription,string,Optional,AgentEvent,,,,, ToolId,string,Optional,AgentEvent,,,,, ToolName,string,Optional,AgentEvent,,,,, ToolOriginalType,string,Optional,AgentEvent,,,,, TransactionIdHex,string,Recommended,Dns,Hexadecimal,,,, Type,string,Mandatory,AlertEvent,,,,, Type,string,Mandatory,AuditEvent,,,,, Type,string,Mandatory,Authentication,,,,, Type,string,Mandatory,Common,,,,, Type,string,Mandatory,DhcpEvent,,,,, Type,string,Mandatory,Dns,,,,, Type,string,Mandatory,FileEvent,,,,, Type,string,Mandatory,NetworkSession,,,,, Type,string,Mandatory,ProcessEvent,,,,, Type,string,Mandatory,RegistryEvent,,,,, Type,string,Mandatory,UserManagement,,,,, Type,string,Mandatory,WebSession,,,,, UpdatedPropertyName,string,Alias,UserManagement,,,EventSubType,, Url,string,Alias,FileEvent,URL,,TargetUrl,, Url,string,Mandatory,WebSession,URL,,,, Url,string,Optional,AlertEvent,,,,, UrlCategory,string,Optional,Dns,,,,, UrlCategory,string,Optional,WebSession,,,,, UrlOriginal,string,Optional,WebSession,URL,,,, User,string,Alias,AlertEvent,,,Username,, User,string,Alias,AssetEntity,,,AssetOwnerId,, User,string,Alias,AuditEvent,,,ActorUsername,, User,string,Alias,DhcpEvent,,,SrcUsername,, User,string,Alias,Dns,,,SrcUsername,, User,string,Alias,FileEvent,,,ActorUsername,, User,string,Alias,NetworkSession,,,DstUsername,, User,string,Alias,ProcessEvent,,,TargetUsername,, User,string,Alias,RegistryEvent,,,ActorUsername,, User,string,Alias,UserManagement,,,ActorUsername,, User,string,Alias,WebSession,,,SrcUsername,, User,string,Optional,Authentication,,,,, UserId,string,Optional,AlertEvent,,,,, UserIdType,string,Conditional,AlertEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,UserId,, Username,string,Recommended,AlertEvent,,,,, UsernameType,string,Conditional,AlertEvent,Enumerated,UPN|Windows|DN|Simple,Username,, UserScope,string,Optional,AlertEvent,,,,, UserScopeId,string,Optional,AlertEvent,,,,, UserSessionId,string,Optional,AlertEvent,,,,, UserType,string,Optional,AlertEvent,Enumerated,Regular|Machine|Admin|System|Application|Service Principal|Other,,, Value,string,Alias,AuditEvent,,,NewValue,, ValueType,string,Optional,AuditEvent,Enumerated,Other,,,