Cortex XQL Schema Reference

Tree view

This book on one page — search it with your browser’s find (Ctrl+F / ⌘F), or jump from the tree.

Cortex XQL Schema Reference

Cortex XQL Schema Reference Guide

This guide describes the fields available in the xdr_data dataset. This dataset contains all data collected from all Cortex product agents, including EDR data, and PAN NGFW data.

XDR_DATA Fields by Actor

This section lists the xdr_data dataset fields grouped according to each actor.

Action Actor

The Action actor is an activity that took place and was recorded by the agent.

Field Name	Data Type	Description
action_app_id_transitions	STRING	List of application ID transitions.
action_boot_instance_cleanup_required	BOOLEAN	Indicates whether or not the agent can clean up open instances from a previous computer restart.
action_boot_time	INTEGER	Computer boot time in ms since epoch time.
action_country	STRING	The destination country of network connections, which is based on the remote IP and GeoLocation enrichment.
action_device_bus_type	INTEGER	For the action, the origin of the device bus type (USB).
action_device_class_guid	STRING	Device setup class GUID.
action_device_class_name	STRING	Device setup class internal friendly name.
action_device_usb_port_connectable	BOOLEAN	Indicates whether or not a user can connect to the USB port that the device is connected to.
action_device_usb_product_id	INTEGER	USB device product ID.
action_device_usb_serial_number	STRING	USB device serial number.
action_device_usb_vendor_id	INTEGER	USB vendor ID.
action_download	INTEGER	Number of downloaded bytes in the last window of time.
action_evtlog_data_fields	STRING	Event log data fields in a JSON array.
action_evtlog_description	STRING	Event log description.
action_evtlog_event_id	INTEGER	Event log event ID.
action_evtlog_level	INTEGER	Event log severity level.
action_evtlog_message	STRING	Event log message field - summary of the event.
action_evtlog_opcode	INTEGER	Event provider specific information, usually similar to "action_evtlog_level".
action_evtlog_pid	INTEGER	Process ID given in the event-log event.
action_evtlog_provider_guid	STRING	Provider GUID
action_evtlog_provider_name	STRING	<p>Windows: Provider name, such as Service Control Manager. Linux: The file from which this event originated.</p>
action_evtlog_raw_params	STRING
action_evtlog_record_id	STRING	Unique ID of this event-log record in the computer's event-log.
action_evtlog_source	INTEGER	Method used to get the event log.
action_evtlog_tid	INTEGER	Thread ID given in the event-log event.
action_evtlog_uid	STRING	User ID given in the event-log event.
action_evtlog_username	STRING	User ID translation of username.
action_evtlog_version	INTEGER	Version of the event log record (private to provider/channel).
action_external_hostname	STRING	<p>The hostname the endpoint connects to. When there is a proxy connection, this value will differ from action_remote_ip.</p>
action_external_port	INTEGER	<p>The external port of the initiated communication. When there is a proxy connection, this value can differ from action_remote_port.</p>
action_file_access_time	INTEGER	The action file access timestamp.
action_file_archive_list	RECORD	Only valid if the file is a ZIP file and the event collection is enabled in the policy.
action_file_attributes	INTEGER	<p>Windows: Bitmask of FILE_ATTRIBUTE_* attributes, which is only relevant for some subtypes. Unix: Always 'null'.</p>
action_file_authenticode_sha1	STRING	SHA-1 (Secure Hash Algorithm 1) of the file signature authenticode.
action_file_authenticode_sha2	STRING	SHA-2 (Secure Hash Algorithm 2) of the file signature authenticode.
action_file_create_time	INTEGER	The action file create timestamp.
action_file_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_device_type	INTEGER	<p>Windows: An enum representing the device type for this file. Regular file = 0 Named pipe = 1</p>
action_file_dir_query	STRING	The query string given to the "query directory" operation.
action_file_dirty_reason	INTEGER	<p>Only valid for sub_type = 6 (write) when a non-null file_size is provided. Indicates the reason this "final" write was issued and why the file hash was recalculated.</p>
action_file_entropy	STRING
action_file_extension	STRING	File extension of action_file_path.
action_file_group	STRING	Linux & MacOS: The new group of the file (user_id).
action_file_group_name	STRING	Name assigned to action_file_group (username).
action_file_hash_control_verdict	STRING	DEPRECATED
action_file_id	STRING	DEPRECATED
action_file_info_company	STRING	Company listed in the file information section of the file.
action_file_info_description	STRING	Description listed in the file information section of the file.
action_file_info_file_version	STRING	File version listed in the file information section of the file.
action_file_info_product_name	STRING	Product name listed in the file information section of the file.
action_file_info_product_version	STRING	Production version listed in the file information section of the file.
action_file_internal_meta_data	STRING	DEPRECATED
action_file_internal_zipped_files	STRING	DEPRECATED
action_file_md5	STRING	The action file hash value in MD5.
action_file_mod_time	INTEGER	The action file modification timestamp.
action_file_mode	RECORD	A representation of the standard UNIX file permissions mask.
action_file_name	STRING	The file name of action_file_path, which is an empty string for directory operations.
action_file_new_file_for_loaded_dll	STRING	DEPRECATED
action_file_original_event_id	STRING	DEPRECATED
action_file_owner	STRING	The new owner of the file according to the user_id.
action_file_owner_name	STRING	The new owner of the file according to the username.
action_file_path	STRING	The path of the file in use.
action_file_prev_type	INTEGER	<p>Before the current write, the previous file type, which is based only on the content of the file. This information can be used to detect header changes. Will be valid ONLY on the file_write event that changes the file type. Windows only</p>
action_file_previous_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_previous_file_extension	STRING	File extension of 'action_file_previous_file_path'.
action_file_previous_file_name	STRING	File name of 'action_file_previous_file_path', which is an empty string for directory operations.
action_file_previous_file_path	STRING	The previous path of the file in use.
action_file_remote_file_host	STRING	<p>This is valid when Cortex XDR/XSIAM accesses a file on a remote computer. This means Cortex XDR/XSIAM is the client.</p>
action_file_remote_file_ip	STRING	<p>This is valid when a remote computer accesses a file on this endpoint. This means Cortex XDR/XSIAM is the client. The remote IP can also be a loopback (127.0.0.1 or ::1).</p>
action_file_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_file_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_file_reparse_path	STRING	Only valid for sub_type = 1/2 (create_new/open). Provides the reparse path if the file was opened through a reparse point.
action_file_sec_desc	STRING	Windows: Security descriptor of the file in SDDL.
action_file_sha256	STRING	SHA256 of the binary.
action_file_signature_product	STRING	Signature product - The product family part of the signature.
action_file_signature_status	INTEGER	The signature status of the file in use.
action_file_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_file_size	INTEGER	Size of the file undergoing the process in bytes.
action_file_suspicious_strings_bitmap	INTEGER	Bitmap of suspicious strings found in file content.
action_file_type	INTEGER	Partial file type recognizer.
action_file_type_changedaction_file_id	INTEGER	DEPRECATED
action_file_type_prev	INTEGER
action_file_wildfire_verdict	STRING	DEPRECATED
action_firewall_direction	STRING	<p>Outbound (1) Inbound (2)</p>
action_firewall_local_ip	STRING	The local IP address in the communication.
action_firewall_local_port	INTEGER	The local port in the communication.
action_firewall_protocol	INTEGER	The IP protocol number as specified in RFC 1700.
action_firewall_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_firewall_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_firewall_rule_guid	STRING
action_is_dll_injection	BOOLEAN	Indicates whether or not the action is a DLL Injection.
action_is_injected_thread	BOOLEAN	Indicates whether or not the action was performed by an injected thread.
action_local_ip	STRING	Source IP address.
action_local_ip_int	INTEGER	Source IP in integer format.
action_module_base_address	STRING	The base address where the library was loaded.
action_module_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_module_file_access_time	INTEGER	Program Executable (PE) metadata collection from the image itself
action_module_file_create_time	INTEGER	Program Executable (PE) metadata collection from the image itself
action_module_file_info	STRING	Program Executable (PE) metadata collection from the image itself
action_module_file_mod_time	INTEGER	Modified time of the file in the module.
action_module_file_size	INTEGER	Size of the file of the process in bytes.
action_module_image_size	INTEGER	Size of the file in virtual memory.
action_module_is_remote	BOOLEAN	Indicates whether or not the module is loaded from a remote process.
action_module_is_replay	BOOLEAN	All existing loaded images are replayed, when the agent starts. This is set to true for images loaded when the agent is not started yet.
action_module_md5	STRING	The module md5 value.
action_module_other_load_location	STRING	This module was already loaded before from a different location. This is the other location.
action_module_path	STRING	The path of the module in use.
action_module_process_instance_id	STRING	Cortex instance ID of the process loading the module.
action_module_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the loaded module.
action_module_sha256	STRING	SHA256 of the binary.
action_module_signature_product	STRING	Signature product - The product family part of the signature.
action_module_signature_status	INTEGER	The signature status of the module in action.
action_module_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_network_connection_id	STRING	The ID of the network connection.
action_network_creation_time	INTEGER	The start time of the network session.
action_network_http	STRING	HTTP headers
action_network_is_ipv6	BOOLEAN	Indicates whether or not action_remote_ip is an IPv6 endpoint.
action_network_is_npcap	BOOLEAN	Indicates whether or not this action is an npcap event.
action_network_is_server	BOOLEAN	<p>True for incoming connections. False for outgoing ones.</p>
action_network_packet_data	STRING	The data is converted to hexadecimal. Each byte is converted to 2 characters representing the character value of the byte.
action_network_protocol	INTEGER	Internet protocol number based on IPPROTO or normalized to IPPROTO (same as Java).
action_network_stats_is_last	BOOLEAN	True, if the connection was terminated, and false otherwise.
action_network_stats_seq	INTEGER	Sequence number of the statistics "packet".
action_network_success	BOOLEAN	Indicates whether or not the session was successful.
action_pkts_received	INTEGER	Total number of packets received so far from the destination to the source.
action_pkts_sent	INTEGER	Total number of packets sent so far from the source to the destination.
action_powered_off	BOOLEAN	True, if the computer is powered off, such as suspended or hibernated, and false otherwise.
action_process_causality_id	STRING	Causality ID of the terminated process.
action_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_process_file_create_time	INTEGER	Creation time of the file that created the process.
action_process_file_info	STRING	Metadata from the exe file of the process.
action_process_file_mod_time	INTEGER	Modification time of the file that created the process.
action_process_file_size	INTEGER	Size of the file involved in the process in bytes.
action_process_image_command_line	STRING	Process command line - The command used to execute the process.
action_process_image_command_line_indices	STRING	Process command line - The command used to execute the process.
action_process_image_extension	STRING	Process image extension - File extension
action_process_image_md5	STRING	MD5 of the binary.
action_process_image_name	STRING	File name of the 'action_process_image_path'.
action_process_image_path	STRING	Process image path - A string identifying the location of the process execution.
action_process_image_sha256	STRING	SHA256 of the binary.
action_process_instance_execution_time	INTEGER	Instance execution time.
action_process_instance_id	STRING	Cortex instance ID of the process.
action_process_integrity_level	INTEGER	Integrity level of the process created.
action_process_is_causality_root	BOOLEAN	Indicates whether or not the created process is a new causality root process.
action_process_is_replay	BOOLEAN	<p>Windows: The following events are replayed: Processes started before the agent is started. Module load events for modules loaded in replayed processes. Drivers loaded using module load before the agent is started. For loaded drivers, the process is always a special KernelProcess.</p>
action_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
action_process_is_txn
action_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the new process
action_process_remote_session_ip	STRING	Windows: When the process was started from a remote Terminal Services session, the IP address of the remote client connected to the session.
action_process_requested_parent_iid	STRING	Windows: Same as the "action_process_requested_parent_pid", but the instance ID.
action_process_requested_parent_pid	INTEGER	Windows: A parent process can request to set the parent-pid of the child process to something other than their own. This is used for a "runas" scenario where the os_actor is different from the actor. Yet, it can also be used by malware to fake the parent pid. This field gives the requested parent pid, while giving the true actor/os_actor for the operation.
action_process_signature_product	STRING	Signature product - The product family part of the signature.
action_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
action_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_process_termination_code	INTEGER	Process exit code.
action_process_termination_date	INTEGER	Instance termination time.
action_process_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
action_process_username	STRING	Name assigned to the 'action_process_user_sid'.
action_protocol	INTEGER	IP protocol of the network event.
action_proxy	BOOLEAN	<p>Indicates whether or not Cortex XDR/XSIAM performed an HTTP proxy resolution to get these fields: action_external_hostname, action_external_port. If true, the hostname/port fields are taken from the HTTP packet data. Otherwise, they are taken from other protocols like DNS.</p>
action_registry_data	STRING	Registry data being written to the specific key.
action_registry_file_path	STRING	<p>Four operations: Load Save Restore Unload</p>
action_registry_key_name	STRING	Registry key name being accessed.
action_registry_old_data	STRING	Registry data being replaced by a new value.
action_registry_old_key_name	STRING	Old registry key name that is being renamed.
action_registry_return_val	INTEGER	Return value from the registry operation.
action_registry_value_name	STRING	Registry value name being accessed.
action_registry_value_type	INTEGER	<p>Regular types: REG_SZ (1) REG_EXPAND_SZ (2) REG_BINARY (3) REG_DWORD (4) REG_DWORD_BIG_ENDIAN (5) REG_LINK (6) REG_MULTI_SZ (7) REG_RESOURCE_LIST (8) REG_FULL_RESOURCE_DESCRIPTOR (9) REG_RESOURCE_REQUIREMENTS_LIST (10) REG_QWORD (11)</p>
action_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_ip_int	INTEGER	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_remote_process_causality_id	STRING	Causality ID of the remote injected process.
action_remote_process_file_access_time	INTEGER	Access time of the file that created the process.
action_remote_process_image_command_line	STRING	Process command line - The command used to execute the process.
action_remote_process_image_extension	STRING	Process image extension - File extension.
action_remote_process_image_md5	STRING	MD5 of the binary.
action_remote_process_image_name	STRING	Image name of the remote injected process.
action_remote_process_image_path	STRING	Process image path - A string identifying the location of the execution.
action_remote_process_image_sha256	STRING	SHA256 of the binary.
action_remote_process_instance_id	STRING	Instance ID of the remote injected process.
action_remote_process_integrity_level	INTEGER	Integrity level of the remote injected process.
action_remote_process_is_causality_root	BOOLEAN	Indicates whether or not the remote process being injected into is a causality root.
action_remote_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the remote process
action_remote_process_signature_product	STRING	Signature product - The product family part of the signature.
action_remote_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
action_remote_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_remote_process_thread_id	INTEGER	Target thread of remote execution.
action_remote_process_thread_start_address	STRING	Memory address of the thread being injected into a remote process.
action_remote_process_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
action_remote_process_username	STRING	Name assigned to the action_process_user_sid field.
action_rpc_func_opnum	INTEGER	Integer identifying the function called.
action_rpc_interface_uuid	STRING	Universally Unique IDentifier (UUID) identifying the interface. An interface is only uniquely identified by the UUID + Major version + Minor version.
action_rpc_interface_version_major	INTEGER	Major version of the Remote Procedure Call (RPC) interface.
action_rpc_interface_version_minor	INTEGER	Minor version of the Remote Procedure Call (RPC) interface.
action_session_duration	INTEGER	Number of milliseconds (ms) since the session started.
action_syscall_etw_based	BOOLEAN	Indicates whether or not the system call based on Event Tracing for Windows (ETW) or on native hooking.
action_syscall_int_params	STRING	Action parameters where the value is an integer in the system call invocation.
action_syscall_stack_ptr	STRING	Stack pointer creating the captured syscall.
action_syscall_string_params	STRING	Action parameters where the value is a string in the system call invocation.
action_syscall_target_image_name	STRING	Base image name of the target process, such as lsass.exe.
action_syscall_target_image_path	STRING	Process image path - A string identifying the location of the execution.
action_syscall_target_instance_id	STRING	Instance ID of the target process, when one exists.
action_syscall_target_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the syscall target process
action_syscall_target_thread_id	INTEGER	Target thread ID of the captured syscall.
action_thread_thread_id	INTEGER	Thread ID creating the captured syscall.
action_total_download	INTEGER	Total number of payload bytes from the destination to the source so far.
action_total_upload	INTEGER	Total number of payload bytes from the source to the destination so far.
action_upload	INTEGER	Number of uploaded bytes in the last time window.
action_user_agent	STRING	The user agent used by an actor to perform an action.
action_user_is_local_session	BOOLEAN	Indicates whether or not the user log in from a remote computer or locally.
action_user_status	INTEGER	<p>Agent user status change event. Enum mapping: 1 - logon 2 - logoff 3 - locked / screen saver on 4 - unlocked / screen saver off 5 - Reconnect 6 - Disconnect</p>
action_user_status_sid	STRING	Security identifier (SID) of the user.
action_username	STRING	Name of the user.
action_local_nat_port	INTEGER	Source NAT port.
action_remote_nat_port	INTEGER	Destination NAT port.
action_local_nat_ip	STRING	Source NAT IP address.
action_remote_nat_ip	STRING	Destination NAT IP address.
action_nat	BOOLEAN	Indicates whether or not the connection is NAT.
action_rpc_items	RECORD	EAL remote procedure call (RPC) data items.
action_category_of_app_id	STRING	App-ID category.
action_sub_category_of_app_id	STRING	App-ID sub category.
action_app_id_risk	INTEGER	App-ID risk
action_location	RECORD	Geolocation information of the source IP.
action_as_data	RECORD	ASN data from the source of the network activity.
action_evtlog_normalized_user	RECORD	A normalized user for the event log event.
action_direction_confidence	INTEGER
action_evtlog_int_fields	RECORD
action_file_pe_info	RECORD	Only valid according to collection policy. Usually, enabled on some write-file events. The field is not aptly named since it sometimes contains info on non-PE files as well.
action_file_last_writer_actor	STRING	Instance ID of the actor that wrote the file.
action_file_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_file_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_reparse_count	INTEGER	Only valid for sub_type = 1/2 (create_new/open), which provides the reparse count if the file was open through a reparse point.
action_file_pipe_impersonation_integrity_level	INTEGER	When the event type is impersonate_pipe, this field contains the integrity level of the token that is used for the impersonation.
action_file_operation_flags	INTEGER	The specified flags for the file operation.
action_file_is_anonymous	BOOLEAN	Indicates whether or not the file was created without an accesible path from the filesystem (`open(..., O_TMPFILE)`, `memfd_create`).
action_module_last_writer_actor	STRING	Instance ID of the actor that wrote the file for the module.
action_module_code_integrity	INTEGER	The value of ci!g_CiOptions when the driver is loaded.
action_module_boot_code_integrity	INTEGER	The value of ci!g_CiOptions at boot time.
action_module_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_module_system_properties	INTEGER	Addition properties of the DLL.
action_module_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_module_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_local_port	INTEGER	Source port
action_network_icmp_data	RECORD	Only valid for event_sub_type = 18. ICMP packet data.
action_network_creation_time_original	INTEGER
action_network_is_loopback	BOOLEAN	<p>Valid for stream_connect, datagram_connect, raw_data, outbound_icmp and stream_statistics. Indicates whether or not both sides of a connection are on the same host. Always false for mac and linux.</p>
action_socket_type	INTEGER	<p>0 : Unknown type 1 : Stream 2 : Datagram 3 : Raw</p>
action_process_pe_load_info	RECORD	Windows: Information about the loaded PE image.
action_process_token	RECORD	Security context of the process.
action_process_privileges	INTEGER	String representing a 64-bit integer. These are the enabled special privileges that the process is running with.
action_process_fds	RECORD	Unix: FD information about 'stdin', 'stdout', and 'stderr'.
action_process_is_container_root	BOOLEAN	Linux: True for the process that creates the container.
action_process_container_info
action_process_ns_pid	INTEGER	The PID of the new process in the relevant Linux namespace.
action_process_ns_user_sid	STRING	Linux-only: Effective UID of the executed binary in the relevant Linux namespace.
action_process_ns_user_real_sid	STRING	Linux-only: Real UID of the executed binary in the relevant Linux namespace.
action_process_is_remote_session_root
action_process_remote_session_port
action_process_local_session_ip
action_process_local_session_port
action_process_static_analysis_score	INTEGER	Static analysis score of executed binary. Scale of 0-1, where 0 is definitely benign, and 1 is definitely malware.
action_process_container_id	STRING	Linux: The ID of the container in which this process is running.
action_process_user_real_sid	STRING	Unix-only: Real UID of the executed binary.
action_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_process_file_access_time	INTEGER	Access time of the file that created the process.
action_process_cwd	STRING	Working directory from which the process was executed.
action_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64 bit.
action_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_process_peb	STRING	Windows: The address of the PEB of the process.
action_process_peb32	STRING	Windows: The address of the PEB32 of the process. Only non-zero if this is a WOW64 process.
action_process_image_auth_sha1	RECORD	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_image_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_last_writer_actor	STRING	Instance ID of the actor that wrote the file for this process.
action_process_script	STRING	When the executable is an interpreter, the script that it is executing.
action_process_script_device_info	RECORD	Info about the device (volume + HW) from which this script was executed.
action_process_environment_variables	MAP	Envrionment variables that were sent on the process execution.
action_remote_process_file_info	RECORD	Metadata from the EXE file of the process.
action_remote_process_file_create_time	INTEGER	Creation time of the file that created the process.
action_remote_process_file_mod_time	INTEGER	Modification time of the file that created the process.
action_remote_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_remote_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
action_remote_process_is_replay	BOOLEAN	Indicates whether or not the agent was alive during the execution of the process.
action_remote_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64 bit.
action_remote_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_remote_process_file_size	INTEGER	Size of the file of the process in bytes.
action_remote_process_image_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_remote_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
action_remote_process_last_writer_actor	STRING	The instance ID of the last writer that changed the file of the process.
action_user_session_id	INTEGER	Windows: Session ID of the process.
action_mount_device_info	RECORD	Info about the device (volume + HW).
action_rpc_func_exception_code	INTEGER	If an exception occurred during this remote procedure call (RPC), the exception code is provided. Otherwise, the value is 0.
action_rpc_interface_name	STRING	Description of the remote procedure call (RPC) interface, taken from the IDL file.
action_rpc_func_str_call_fields	RECORD	<p>Parameters where the keys are the names of the argument in the function call. The values are the values of the parameters. Values are strings. For instance, if we have a remote procedure call (RPC) to CreateService(ServiceName, ServiceType), we will get something like { "ServiceName": "MyServiceName1", "ServiceType": "3"}.</p>
action_rpc_func_name	STRING	Function name taken from the IDL file.
action_rpc_func_int_call_fields	RECORD	Same as the field action_rpc_func_str_call_fields, but the values are integers. Since the values are in a uint64_t format, they are still serialized as strings.
action_device_usb_vendor_name
action_device_usb_product_name
action_device_usb_interface_class	INTEGER
action_device_usb_interface_sub_class	INTEGER
action_thread_start_address	INTEGER	Start address of the thread function, which is serialized as a string as it can be a true 64-bit address.
action_thread_parent_pid	INTEGER	Windows: Same as the actor info.
action_thread_parent_tid	INTEGER	Windows: Same as the actor info.
action_thread_parent_iid	STRING	Windows: Same as the actor info.
action_thread_child_pid	INTEGER
action_thread_child_tid	INTEGER
action_thread_child_iid	STRING
action_thread_stack_base	STRING	Windows: Base of the stack.
action_thread_stack_limit	STRING	Windows: Limit of the stack.
action_thread_teb	STRING	Windows: Address of the TEB of the thread.
action_process_handle_is_kernel	BOOLEAN	Indicates whether or not a handle is used by the kernel.
action_process_handle_granted_access	INTEGER	Access rights that were granted when opening the handle.
action_process_handle_opened_process_pid	INTEGER	PID of the process opened.
action_process_handle_opened_process_iid	STRING	IID of the process opened.
address_mapping	RECORD	<p>symbol_name: Name of the suspicious function. image_path: Path of the image containing the function or image injected to. index: By default, set to 1. In Syscall events, points to a function parameter number.</p>
action_ns_flags	INTEGER	<p>Unshare: Flags raw value. Setns: nstype raw value.</p>
action_ns_path	STRING	Setns-only: Path to the namespace file descriptor.
action_time_change_clock_diff_ms	INTEGER	Difference in milliseconds from previous system time.
action_trace_flags	INTEGER	Flags that were sent to the ptrace function.
action_trace_ret	INTEGER	Return value of the ptrace function.
action_trace_request_id	INTEGER	Request ID of the ptrace function.

Actor Actor

The Actor actor is the process that performed the action.

Field Name	Data Type	Description
actor_causality_id	STRING	Will match 'causality_actor_causality_id' in the causality owner actor fields.
actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
actor_effective_username	STRING	<p>Name assigned to 'actor_effective_user_sid'. Win: Includes the domain.</p>
actor_is_injected_thread	BOOLEAN	Indicates whether or not a user can connect to the USB port that the device is connected to.
actor_os_process_instance_id	STRING	Cortex XDR/XSIAM unique identifier for the operating system's actor process.
actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
actor_primary_username	STRING	Name assigned to the user_sid.
actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
actor_process_causality_id	STRING	Cortex XDR/XSIAM unique causality ID for the actor casuality chain.
actor_process_command_line	STRING	Process command line - The command used to execute the process.
actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
actor_process_execution_time	INTEGER	Timestamp of the execution in epoch time.
actor_process_file_access_time	INTEGER	Creation time of the file that created the actor process.
actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
actor_process_image_command_line	STRING	Process command line - The command used to execute the process.
actor_process_image_extension	STRING	Process image extension - File extension.
actor_process_image_md5	STRING	MD5 of the binary.
actor_process_image_name	STRING	File name of the actor_process_image_path.
actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
actor_process_image_sha256	STRING	SHA256 of the binary.
actor_process_instance_id	STRING	Cortex XDR/XSIAM unique identifier of the actor process.
actor_process_integrity_level	INTEGER	Integrity level of the process.
actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is a 64-bit process.
actor_process_is_native	BOOLEAN	Indicates whether or not this process a "native process".
actor_process_is_replay	BOOLEAN	Indicates whether or not the agent was alive during the execution of the process.
actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the actor process.
actor_process_session_id	INTEGER	Windows: Session ID of the process.
actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature embedded inside the Program Executable (PE) or part of an external catalog file.
actor_process_signature_product	STRING	Signature product - The product family part of the signature.
actor_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
actor_remote_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe.
actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
actor_thread_thread_id	INTEGER	An identifier of the OS thread which is responsible for the event.
actor_type	INTEGER	<p>Enum describing actor type: Local = 1, where the actor is a local process. RemoteRpcNamedPipe = 2, where the actor is a remote procedure call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3, where the actor is a remote procedure call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4, where the actor is a remote procedure call (RPC) over a TCP connection. RemoteFileSmb = 5, where the actor is a remote file operation over SMB.</p>
actor_primary_normalized_user	RECORD	A normalized user for the actor.
actor_effective_normalized_user	RECORD	Normalized user information.
actor_container_info	RECORD	Container information for the process.
actor_process_ns_pid
actor_ns_user_sid
actor_process_container_id
actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
actor_rpc_protocol	STRING	MS-RPC protocol type.
actor_local_ip	STRING	Source IP of the network activity.
actor_local_port	INTEGER	Source port for the network activity
actor_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
actor_process_image_auth_sha1	STRING	Process image SHA-1 authenticode.
actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the actor process image.
actor_process_static_analysis_score	DEPRECATED
actor_process_file_original_name	STRING	Original file name of the actor image based on the file information metadata.
actor_process_file_internal_name	STRING	Internal name of the actor image based on the file information metadata.

The Causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR/XSIAM agent identified as being responsible for initiating the process tree.

Field Name	Data Type	Description
causality_actor_causality_id	STRING	Causality ID of the causality actor.
causality_actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
causality_actor_effective_username	STRING	Source effective username.
causality_actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
causality_actor_primary_username	STRING	Name assigned to the user_sid.
causality_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
causality_actor_process_causality_id	STRING	Causality ID of the causality actor process.
causality_actor_process_command_line	STRING	Process command line - The command used to execute the process.
causality_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
causality_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
causality_actor_process_execution_time	INTEGER	Causality actor process execution time in epoch time.
causality_actor_process_file_access_time	INTEGER	Access time of the file that created the process.
causality_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
causality_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
causality_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
causality_actor_process_image_extension	STRING	Process image extension - File extension.
causality_actor_process_image_md5	STRING	MD5 of the binary.
causality_actor_process_image_name	STRING	File name of the 'causality_actor_process_image_path'.
causality_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
causality_actor_process_image_sha256	STRING	SHA256 of the binary.
causality_actor_process_instance_id	STRING	Cortex XDR/XSIAM unique identifier for the causality actor process.
causality_actor_process_integrity_level	INTEGER	Process integrity level.
causality_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64-bit.
causality_actor_process_is_native	BOOLEAN	Indicates whether this process is a "native process". On a 32-bit machine the value is always true; on a 64-bit machine, it is true, if the process is a 64-bit process.
causality_actor_process_is_replay	BOOLEAN	Indicates whether or not the Agent was alive during the execution of the process.
causality_actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
causality_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
causality_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the causality actor process
causality_actor_process_session_id	INTEGER	Windows: Session ID of the process.
causality_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file.
causality_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
causality_actor_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, which means that MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
causality_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
causality_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
causality_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
causality_actor_remote_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe.
causality_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
causality_actor_remote_port_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
causality_actor_session_id	INTEGER	Sesion ID
causality_actor_type	INTEGER	<p>Local = 1. The actor is a local process RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection. RemoteFileSmb = 5. The actor is a remote file operation over SMB.</p>
causality_actor_primary_normalized_user	RECORD	Normalized user information.
causality_actor_container_info	RECORD	The container information for the process.
causality_actor_process_ns_pid
causality_actor_ns_user_sid
causality_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
causality_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
causality_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
causality_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
causality_actor_rpc_protocol	STRING	MS-RPC protocol type.
causality_actor_local_ip
causality_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the causality actor process image.
causality_actor_process_static_analysis_score	DEPRECATED
causality_actor_local_port
causality_actor_process_container_id
causality_actor_process_image_auth_sha1	STRING	Process image SHA-2 authenticode.
causality_actor_process_image_auth_sha2	STRING	Process image SHA-1 authenticode.
causality_actor_process_file_original_name	STRING	Original file name of the casuality actor image based on the file information metadata.
causality_actor_process_file_internal_name	STRING	Internal name of the casuality actor image based on the file information metadata.

DST Action Actor

The DST Action actor is the receiving process for actions performed remotely from one host to another.

Field Name	Data Type	Description
dst_actor_causality_id	STRING	Causality ID of the destination actor.
dst_actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_actor_effective_username	STRING	Name assigned to the 'actor_effective_user_sid'.
dst_actor_is_injected_thread	BOOLEAN	Indicates whether or not this destination actor's thread is an injected thread.
dst_actor_os_process_instance_id	STRING	Cortex XDR/XSIAM unique identifier for the destination operating system's actor process.
dst_actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective unique identifier (UID) of the executed binary.</p>
dst_actor_primary_username	STRING	Name assigned to the user_sid.
dst_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_actor_process_causality_id	STRING	Causality ID of the destination actor process.
dst_actor_process_command_line	STRING	Process command line - The command used to execute the process.
dst_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
dst_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
dst_actor_process_execution_time	INTEGER	Destination actor process execution time in epoch time.
dst_actor_process_file_access_time	INTEGER	Access time of the file that created the destination actor process.
dst_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
dst_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
dst_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
dst_actor_process_image_command_line	STRING	Process command line - The command used to execute the process.
dst_actor_process_image_extension	STRING	Process image extension - File extension.
dst_actor_process_image_md5	STRING	MD5 of the binary.
dst_actor_process_image_name	STRING	File name of the 'dst_actor_process_image_path'.
dst_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
dst_actor_process_image_sha256	STRING	SHA256 of the binary.
dst_actor_process_instance_id	STRING	Process instance ID.
dst_actor_process_integrity_level	INTEGER	Process integrity level.
dst_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64-bit.
dst_actor_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine the value is always true, and on a 64-bit machine the value is true, if the process is 64-bit.
dst_actor_process_is_replay	BOOLEAN	A boolean value that specifies whether the Agent was alive during the execution of the process.
dst_actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
dst_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the destination actor process
dst_actor_process_session_id	INTEGER	Windows: Session ID of the process.
dst_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file.
dst_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
dst_actor_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5. Means that MD5 is used as the hash algorithm. Unsupported = 6. This means signature was not calculated. InvalidCVE2020_0601 = 7. This means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601 Deleted = 8. Means that the file was deleted by the time the agent tried to calculate signature.</p>
dst_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
dst_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
dst_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
dst_actor_remote_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe.
dst_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
dst_actor_thread_thread_id	INTEGER	An identifier of the operating system (OS) thread responsible for the event.
dst_actor_type	INTEGER	<p>The type of actor: Local = 1. The actor is a local process. RemoteRpcNamedPipe = 2. The actor is a Remote Procedure Call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3. The actor is a Remote Procedure Call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4. The actor is a Remote Procedure Call (RPC) over a TCP connection. RemoteFileSmb = 5. The actor is a remote file operation over SMB.</p>
dst_actor_primary_normalized_user	RECORD	A normalized user for the destination actor.
dst_actor_effective_normalized_user	RECORD	A normalized user for the destination actor.
dst_actor_container_info	RECORD	Container information for the destination process.
dst_actor_process_ns_pid
dst_actor_ns_user_sid
dst_actor_process_container_id	STRING	Container ID that is running this destination process.
dst_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
dst_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
dst_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
dst_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
dst_actor_rpc_protocol	STRING	MS-RPC protocol type.
dst_actor_local_ip
dst_actor_local_port
dst_actor_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
dst_actor_process_image_auth_sha1	STRING	Process image SHA-1 authenticode.
dst_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the actor process image.
dst_actor_process_static_analysis_score	DEPRECATED
dst_actor_process_file_original_name	STRING	Original file name of the casuality actor image based on the file information metadata.
dst_actor_process_file_internal_name	STRING	Internal name of the casuality actor image based on the file information metadata.

DST Causality Actor

The DST Causality actor is the process identified by the operation system on the remote host as the process that performed an action that was responsible for the entire chain of execution.

Field Name	Data Type	Description
dst_causality_actor_causality_id	STRING	Causality chain identifier.
dst_causality_actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_causality_actor_effective_username	STRING	Source effective username.
dst_causality_actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_causality_actor_primary_username	STRING	Name assigned to the user_sid.
dst_causality_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_causality_actor_process_causality_id	STRING	Process causality chain identifier
dst_causality_actor_process_command_line	STRING	Process command line - The command used to execute the process.
dst_causality_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
dst_causality_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
dst_causality_actor_process_execution_time	INTEGER	Process execution time.
dst_causality_actor_process_file_access_time	INTEGER	Access time of the file that created the process.
dst_causality_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
dst_causality_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
dst_causality_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
dst_causality_actor_process_image_extension	STRING	Process image extension - File extension.
dst_causality_actor_process_image_md5	STRING	MD5 of the binary.
dst_causality_actor_process_image_name	STRING	Process image name.
dst_causality_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
dst_causality_actor_process_image_sha256	STRING	SHA256 of the binary.
dst_causality_actor_process_instance_id	STRING	Process instance identifier.
dst_causality_actor_process_integrity_level	INTEGER	Process integrity level.
dst_causality_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64-bit.
dst_causality_actor_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on 64-bit machine, the value is true, if the process is 64-bit.
dst_causality_actor_process_is_replay	BOOLEAN	Indicates whether or not the agent is alive during the execution of the process.
dst_causality_actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
dst_causality_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_causality_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the destination causality actor process
dst_causality_actor_process_session_id	INTEGER	Windows: Session ID of the process.
dst_causality_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file.
dst_causality_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
dst_causality_actor_process_signature_status	INTEGER	<p>Process Signature Status: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, which means that MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means the file was deleted by the time the agent tried to calculate the signature.</p>
dst_causality_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
dst_causality_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
dst_causality_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
dst_causality_actor_remote_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe.
dst_causality_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
dst_causality_actor_remote_port_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
dst_causality_actor_session_id	INTEGER	Session ID of the actor process.
dst_causality_actor_type	INTEGER	<p>Type of Causality Actor: Local = 1. The actor is a local process. RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection. RemoteFileSmb = 5. The actor is a remote file operation over a SMB.</p>
dst_causality_actor_container_info	RECORD	Container information for the process.
dst_causality_actor_process_ns_pid
dst_causality_actor_ns_user_sid
dst_causality_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
dst_causality_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
dst_causality_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
dst_causality_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
dst_causality_actor_rpc_protocol	STRING	MS-RPC protocol type.
dst_causality_actor_local_ip
dst_causality_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the causality actor process image.
dst_causality_actor_process_static_analysis_score	DEPRECATED
dst_causality_actor_local_port
dst_causality_actor_process_container_id
dst_causality_actor_process_image_auth_sha1	STRING	Process image SHA-2 authenticode.
dst_causality_actor_process_image_auth_sha2	STRING	Process image SHA-1 authenticode.
dst_causality_actor_process_file_original_name	STRING	Original file name of the casuality actor image based on the file information metadata.
dst_causality_actor_process_file_internal_name	STRING	Internal name of the casuality actor image based on the file information metadata.

DST OS Actor

The DST OS actor is the process identified by the operation system on the remote host as the process that performed an action that was responsible for the entire chain of execution.

Field Name	Data Type	Description
dst_os_actor_causality_id	STRING	Causality chain ID.
dst_os_actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_os_actor_effective_username	STRING	Effective username
dst_os_actor_is_injected_thread	BOOLEAN	Indicates whether or not the thread is injected.
dst_os_actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_os_actor_primary_username	STRING	Name assigned to the user_sid.
dst_os_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_os_actor_process_causality_id	STRING	Process causality chain ID.
dst_os_actor_process_command_line	STRING	Process command line - The command used to execute the process.
dst_os_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
dst_os_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
dst_os_actor_process_execution_time	INTEGER	Process execution time in epoch time.
dst_os_actor_process_file_access_time	INTEGER	Access time of the file that created the process.
dst_os_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
dst_os_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
dst_os_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
dst_os_actor_process_image_command_line	STRING	Process command line - The command used to execute the process.
dst_os_actor_process_image_extension	STRING	Process image extension - File extension.
dst_os_actor_process_image_md5	STRING	MD5 of the binary.
dst_os_actor_process_image_name	STRING	Process image name.
dst_os_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
dst_os_actor_process_image_sha256	STRING	SHA256 of the binary.
dst_os_actor_process_instance_id	STRING	Process instance ID.
dst_os_actor_process_integrity_level	INTEGER	Integrity level of the process.
dst_os_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64-bit.
dst_os_actor_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on 64-bit machine, the value is true, if the process is 64-bit.
dst_os_actor_process_is_replay	BOOLEAN	<p>Indicates whether or not the process event data is replayed or not. Replayed means that the agent sent the data after the action occurred, for example, after a reboot.</p>
dst_os_actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
dst_os_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_os_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the destination operating system actor process.
dst_os_actor_process_session_id	INTEGER	Windows: Session ID of the process.
dst_os_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable or part of an external catalog file.
dst_os_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
dst_os_actor_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
dst_os_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
dst_os_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
dst_os_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
dst_os_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
dst_os_actor_session_id	INTEGER	Windows: Session ID of the process.
dst_os_actor_thread_thread_id	INTEGER	An identifier of the Operating System (OS) thread responsible for the event.
dst_os_actor_type	INTEGER	<p>Operating System actor type: Local = 1. The actor is a local process. RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection. RemoteFileSmb = 5. The actor is a remote file operation over a SMB connection.</p>
dst_os_actor_container_info	RECORD	Container information for the process.
dst_os_actor_process_ns_pid
dst_os_actor_ns_user_sid
dst_os_actor_process_container_id
dst_os_actor_process_image_auth_sha1	STRING	Process image SHA-1 authenticode.
dst_os_actor_process_image_auth_sha2	STRING	The process image SHA-2 authenticode.
dst_os_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the os actor process image.
dst_os_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
dst_os_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
dst_os_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
dst_os_actor_rpc_protocol	STRING	MS-RPC protocol type.
dst_os_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
dst_os_actor_process_static_analysis_score	DEPRECATED
dst_os_actor_process_file_original_name	STRING	Original file name of the destination os actor image based on the file information metadata.
dst_os_actor_process_file_internal_name	STRING	Internal name of the destination os actor image based on the file information metadata.

OS Actor

The OS actor is the process identified by the operation system as the process that performed the action.

Field Name	Data Type	Description
os_actor_causality_id	STRING	the causality chain identifier of the Operating System actor
os_actor_effective_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
os_actor_effective_username	STRING	the username which launched the Operating System actor process
os_actor_is_injected_thread	BOOLEAN	Indicates whether or not the thread is injected to the operating system actor process.
os_actor_primary_user_sid	STRING	<p>Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
os_actor_primary_username	STRING	Name assigned to the user_sid.
os_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
os_actor_process_causality_id	STRING	the causality chain identifier of the Operating System actor process
os_actor_process_command_line	STRING	Process command line - The command used to execute the process.
os_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
os_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
os_actor_process_execution_time	INTEGER	the execution timestamp
os_actor_process_file_access_time	INTEGER	Access time of the file that created the process
os_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
os_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
os_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
os_actor_process_image_command_line	STRING	Process command line - The command used to execute the process.
os_actor_process_image_extension	STRING	Process image extension - File extension.
os_actor_process_image_md5	STRING	MD5 of the binary.
os_actor_process_image_name	STRING	the process image name on the disk
os_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
os_actor_process_image_sha256	STRING	SHA256 of the binary.
os_actor_process_instance_id	STRING	Process instance identifier.
os_actor_process_integrity_level	INTEGER	the integrity level of the process (INTEGER)
os_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is compiled for 64 bit.
os_actor_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32 bit machine the value will be always true, on 64 bit machine it will be true if the process is 64 bit.
os_actor_process_is_replay	BOOLEAN	<p>Indicates whether or not the process event data is replayed or not. replayed means that the agent sent the data after the action occured for example after a reboot</p>
os_actor_process_is_special	INTEGER	<p>Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3</p>
os_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
os_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the operating system actor process
os_actor_process_session_id	INTEGER	Windows: Session ID of the process.
os_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file.
os_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
os_actor_process_signature_status	INTEGER	<p>Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
os_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
os_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
os_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
os_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
os_actor_session_id	INTEGER	session id of the actor process
os_actor_thread_thread_id	INTEGER	thread id of the thread in the process which made the action
os_actor_type	INTEGER	<p>Enum describing actor type: Local = 1. The actor is a local process RemoteRpcNamedPipe = 2. The actor is remote RPC over a named-pipe/SMB connection RemoteRpcHttp = 3. The actor is remote RPC a remote HTTP connection RemoteRpcTcp = 4. The actor is remote RPC over a TCP connection RemoteFileSmb = 5. The actor is a remote file operation over SMB</p>
os_actor_container_info	RECORD	Container information for the process.
os_actor_process_ns_pid
os_actor_ns_user_sid
os_actor_process_container_id
os_actor_process_image_auth_sha1	STRING	Process image SHA-1 authenticode.
os_actor_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
os_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the os actor process image.
os_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
os_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
os_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
os_actor_rpc_protocol	STRING	MS-RPC protocol type.
os_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
os_actor_process_static_analysis_score	DEPRECATED
os_actor_process_file_original_name	STRING	Original file name of the casuality actor image based on the file information metadata.
os_actor_process_file_internal_name	STRING	Internal name of the casuality actor image based on the file information metadata.

XDR_DATA Fields

This section lists all of the xdr_data dataset fields in alphabetical order.

Field Name	Data Type	Description
_insert_time	INTEGER	System field: The time the data entry was added to the system.
_product	STRING	System field: The data product as ingested from the data collector.
_raw_json	RECORD	System field: All raw data as ingested from the data collector in a JSON format.
_raw_log	STRING	System field: All raw data as ingested from the data collector in a text format.
_time	INTEGER	System field: Data entry's timestamp. If unknown, then the time the data entry was added to the database.
_vendor	STRING	System field: The data vendor as ingested from the data collector.
action_threat_ids	STRING	Threat IDs
additional_info	STRING	Additional information for any event that occurred (GlobalProtect).
agent_content_version	STRING	The agent content version.
agent_external_ip	STRING	External IP of the agent reporting this event.
agent_host_boot_time	INTEGER	Last time this host was started in epoch time.
agent_hostname	STRING	Hostname of the agent.
agent_id	STRING	A unique identifier per agent.
agent_install_type	INTEGER	<p>Agent installation type with the following possible values: 0 - Standard agent 1 - Virtual Desktop Infrastructure (VDI) instance 2 - Virtual Desktop Infrastructure (VDI) golden image 4 - Temporary session 5 - Light agent</p>
agent_interface_map	RECORD	Agent interface maps (IPs and Mac).
agent_ip_addresses	STRING	All IPv4 interface addresses.
agent_ip_addresses_v6	STRING	All IPv6 interface addresses.
agent_is_vdi	BOOLEAN	Indicates whether or not the agent is a VDI agent.
agent_mac_addresses	RECORD	Mac addresses assigned to all interfaces for this agent.
agent_os_sub_type	STRING	A lengthier description of the operating system (OS) type.
agent_os_type	INTEGER	<p>Windows = 1 MacOS = 2 Linux = 4</p>
agent_request_time
agent_session_start_time	INTEGER	Indicates when the agent was started.
agent_status_component	STRING	Gives the name of the endpoint detection and response (EDR) filter that was updated.
agent_version	STRING	The agent version.
associated_event_ids	STRING
associated_mac	STRING	Associated mac addresses.
association_strength	INTEGER	<p>Indicates whether an agent_id includes an associated value using this enum mapping: 10 IP Address 20 MAC 30 Hardware ID 35 Collector ID 40 Agent ID 45 Collector Event Data 50 Event Data</p>
auth_client	STRING	The client-side host.
auth_client_type	STRING	Type of device that the client operated from, such as a computer.
auth_correlation_id	STRING	Identifies events from seperate sessions that occurred together as part of an operation.
auth_domain	STRING	User-side domain name.
auth_identity	STRING	Client-side identification.
auth_identity_display_name	STRING	Display name of the authentication actor.
auth_identity_id	STRING	Identity \ Principal ID
auth_identity_sid	STRING	Identity SID
auth_is_interactive	BOOLEAN	<p>True: Interactive sign-ins, where a user manually signs in using their username and password. False: Non-interactive sign-ins, such as a service-to-service authentication.</p>
auth_method	STRING	Auth method, such as a publickey and password.
auth_mfa_needed	BOOLEAN	Indicates whether or not a Multi-factor authentication (MFA) is required.
auth_normalized_user	RECORD	Normalized user information.
auth_outcome	STRING	Authenticaion attempt outcome as either "sucess", "fail", "unknown", "SKIPPED", "ALLOW", "DENY", or "CHALLENGE".
auth_outcome_reason	STRING	Event success status description.
auth_server	STRING	Server-side host.
auth_service	STRING	Authentication service name.
auth_service_sid	STRING	Service SID
auth_target	STRING	Authentication target host.
auth_target_id	STRING	Target \ Resource ID
azure_ad_resource_display_name	STRING	Display name of the Azure AD resource (authentication server).
azure_ad_resource_id	STRING	Resource ID
azure_ad_resource_tenant_id	STRING	Resource tenant ID.
azure_authentication_info
azure_authentication_risk_info
backtrace_identities	RECORD
cef_device_product	STRING	Extracted CEF product.
cef_device_vendor	STRING	Extracted CEF vendor.
cef_device_version	STRING	Extracted CEF device version.
cef_extension	STRING	Extracted CEF extension.
cef_severity	STRING	Extracted CEF severity.
cef_signature_id	STRING	Extracted CEF signature ID.
cef_version	INTEGER	Extracted CEF version.
checkpoint_vpn_data
cisco_vpn_data
client_version	INTEGER	The endpoints GlobalProtect version.
client_version_str
clipboard_data_size	INTEGER	Size of data.
clipboard_data_type	INTEGER	CF_UNICODETEXT, CF_BITMAP
clipboard_source_iid	STRING	IID of the source process of the copied data.
cloud_entity	RECORD	Cloud provider information on the source IP of the activity.
customerId	STRING	Extracted customer ID.
device_id	RECORD
device_name
dfe_labels	STRING	Story label
directionality_strength
dns_query_items	RECORD	List of all the request items (name and type).
dns_query_name	STRING	DNS request name.
dns_query_name_domain_randomness	RECORD	Domain randomness score.
dns_query_type	STRING	DNS query type.
dns_reply_code	STRING	<p>0 -> No error 1 -> Format Error 2 -> Server Failure 3 -> Non-Existent Domain 4 -> Not Implemented 5 -> Query Refused 6 -> Name Exists when it should not 7 -> RR Set Exists when it should not 8 -> RR Set that should exist does not 9 -> Server Not Authoritative for zone 10 -> Name not contained in zone 16 -> Bad OPT Version 16 -> TSIG Signature Failure 17 -> Key not recognized 18 -> Signature out of time window 19 -> Bad TKEY Mode 20 -> Duplicate key name 21 -> Algorithm not supported 22 -> Bad Truncation</p>
dns_reply_codes	RECORD	DNS reply codes for the DNS query.
dns_resolutions	RECORD	DNS resolutions for query. Comprised of the Resource Record name, type, and value for each resolution item.
dst_action_as_data	RECORD	ASN data from the destination of the network activity.
dst_action_boot_time	INTEGER	Destination computer boot time in ms since the last epoch time.
dst_action_country	STRING	Destination country of the action.
dst_action_external_hostname	STRING	The hostname Cortex XDR/XSIAM connect to. For a proxy connection, this value differs from the action_remote_ip.
dst_action_external_hostname_domain_randomness	RECORD	Domain randomness score.
dst_action_external_port	INTEGER	<p>The port Cortex XDR/XSIAM connects to. For a proxy connection, this value can differ from the action_remote_port.</p>
dst_action_location	RECORD	Geolocation information of the destination IP.
dst_action_powered_off	BOOLEAN	<p>True, if the computer is powered off, such as suspend or hibernate. False, otherwise.</p>
dst_action_url_category	STRING	Next-Generation Firewall (NGFW) URL category.
dst_action_user_agent	STRING	The user agent used by an actor to perform an action.
dst_action_user_is_local_session	BOOLEAN	Indicates whether or not the user login from a remote computer or locally.
dst_action_user_session_id	INTEGER	Session ID of the action.
dst_action_user_status	INTEGER	Same as the event sub-type.
dst_action_user_status_sid	STRING	Security identifier (SID) of the user.
dst_action_username	STRING	Name of the destination user.
dst_agent_content_version	STRING	Agent content version.
dst_agent_external_ip	STRING	The IP that the destination agent reported this data.
dst_agent_host_boot_time	INTEGER	Host boot time in epoch time.
dst_agent_hostname	STRING	Agent hostname
dst_agent_id	STRING	Agent ID
dst_agent_install_type	INTEGER	<p>Type of agent installation: 0 - Standard agent 1 - VDI instance 2 - VDI golden image 4 - Temporary session 5 - Light agent</p>
dst_agent_interface_map	RECORD	Agent interface maps (IPs and Mac)
dst_agent_ip_addresses	STRING	Agent IPv4 addresses.
dst_agent_ip_addresses_v6	STRING	Agent IPv6 addresses.
dst_agent_is_vdi	BOOLEAN	Indicates whether or not the agent is a VDI installation.
dst_agent_os_sub_type	STRING	A lengthier description of the Operating System (OS) type.
dst_agent_os_type	INTEGER	<p>Agent Operating System types: Windows = 1 MacOS = 2 Linux = 4</p>
dst_agent_request_time
dst_agent_session_start_time	INTEGER	When the agent was started.
dst_agent_status_component	STRING
dst_agent_version	STRING	Agent version
dst_associated_mac	STRING	Associated MAC address.
dst_association_strength	INTEGER	<p>Specifies whether an agent_id includes an associated value, using this enum mapping: 0 = No association 10 = IP Address 15 = Kerberos 20 = MAC 30 = Hardware ID 35 = Collector ID 40 = Agent ID 45 = Collector Event Data 50 = Event Data</p>
dst_causality_actor_primary_normalized_user	RECORD	A normalized user for the causality chain.
dst_cloud_entity	RECORD	Cloud provider information on the destination IP of the activity.
dst_device_id
dst_event_utc_diff_minutes	INTEGER	The difference in minutes of the original timestamp from UTC, which identifies the agent's original time zone.
dst_host_metadata_domain	STRING	Domain of the host.
dst_host_metadata_hostname	STRING
Hostname
dst_host_metadata_interface_map	RECORD	Agent interface maps (IPs and Mac)
dst_is_internal_ip	BOOLEAN	Indicates whether or not the source IP is outside the private range.
dst_mac	STRING	MAC address
dst_manifest_file_version	INTEGER
dst_tcp_flags	INTEGER	TCP flags
dst_trapsId	STRING	DEPRECATED
dst_ttl	INTEGER	The closest time-to-live (TTL) preceding / following the sensor.
dst_user_id	STRING	<p>Windows: Primary user token of the executed binary. Unix: Effective UID of the executed binary.</p>
dst_xdr_pro_lite	BOOLEAN	Indicates whether or not the destination agent is running XDR Pro (not XTH).
dynamic_event_int_map	RECORD	DEPRECATED
dynamic_event_string_map	RECORD	Same as dynamic_event_int_map, only those are string values.
event_address_code_symbol	STRING
event_address_mapped_image_path	STRING	Windows: DLL path for the address (in process address-space) this event refers to. For example, in thread-start events, this is the path of the DLL the thread was started in.
event_allocation_base_shellcode_buffer	STRING	Hexlified buffer of shellcode at the base of the allocation of the event associated buffer.
event_call_region_base_address	INTEGER	Call region base address related to the event.
event_call_region_shellcode_buffer	STRING	Hexlified buffer of shellcode at the call region.
event_causality_mark_of_cain	INTEGER	<p>Indicates whether a security event, such as BTP and static analysis, was raised in this causality. kNotification (1) - A security event has occurred and has NOT been prevented. kPrevention (2) - A security event has occurred but was (partially or fully) prevented.</p>
event_direct_syscall_ip_mapped_file_path	STRING	When the event is a direct syscall, this field contains the DLL that the syscall originated from.
event_id	STRING	Event identifier
event_impersonation_status	INTEGER	<p>This is equivalent to the event_is_impersonated field, but sometimes the status is unknown. The other field can't account for this as it's a boolean field. Unknown = 0 Impersonated = 1 Not-Impersonated = 2</p>
event_invalidity_field	STRING	Set by the preprocessor when detecting that an event is invalid. The name of the field which caused the event to be invalid.
event_is_boot_replay	BOOLEAN	A boolean value that is true during the the first replay.
event_is_duplicated_replay	BOOLEAN	A boolean value that is true if the event was already sent before and another replay sends this event again.
event_is_impersonated	BOOLEAN	Windows: Indicates whether or not the thread performing the event is impersonating.
event_is_replay	BOOLEAN	Indicates whether or not the event is part of the system state replay sent when the agent is started.
event_is_simulated	BOOLEAN	Indicates whether or not this event was simulated by the TMS.
event_page_base_shellcode_buffer	STRING	Hexlified buffer of shellcode at the base of the page of the event associated buffer.
event_resolved_stack_trace	STRING	Stack trace related to the event.
event_rpc_func_opnum	INTEGER	Integer identifying the function being called.
event_rpc_interface_uuid	STRING	UUID identifying the interface.
event_rpc_interface_version_major	INTEGER	Major version of the remote procedure call (RPC) interface.
event_rpc_interface_version_minor	INTEGER	minor version of the remote procedure call (RPC) interface.
event_rpc_protocol	INTEGER	<p>Enum representing the remote procedure call (RPC) protocol: LocalRpc (ALPC port) = 0 Tcp = 1 NamedPipes = 2 Http = 3</p>
event_shellcode_address	INTEGER	The address of the shellcode in the usermode callstack.
event_source_bitmask	INTEGER	<p>Bitmask of the sources involved in producing the event: Simulated - 0x01 Kernel-Module - 0x02 EBPF - 0x04 Fanotify - 0x08 Path-Resolved - 0x10</p>
event_sub_type	INTEGER	<p>This field is updated based on the event type defined in the event_type field. For each event type, there are multiple event sub types. To see the possible values for the event_type and event_sub_type, create an XQL query with a filter stage, which autocompletes the values.</p>
event_thread_context	STRING	<p>A string representing a JSON array containing thread specific context. Note: From XDR agent 8.2, this field is only relevant for office macros.</p>
event_timestamp	INTEGER	Integer indicating when the event occurred.
event_timestamp_original	INTEGER	Event timestamp in epoch time.
event_type	INTEGER	<p>A unique identifier of the event type: Process = 1 Network = 2 File = 3 Registry = 4 Injection = 5 LoadImage = 6 UserStatusChange = 7 TimeChange = 8 Thread = 9 Causality = 10 HostStatusChange = 11 AgentStatusChange = 12 InternalStatistics = 13 ProcessHandle = 14 WindowsEventLog = 15 EpmStatus = 16 MetadataChange = 17 SystemCall = 18 Device = 19 HostFirewall = 23</p>
event_user_presence	BOOLEAN	<p>Indicates whether or not there was a physical user presence on the machine. Windows: The value is"true" if the user session was unlocked during the event.</p>
event_user_presence_status	INTEGER	<p>This is equivalent to the event_user_presence field, but sometimes the status is unknown. The other field can't account for this as it's a boolean field. Unknown = 0 User not present = 1 User present = 2</p>
event_user_thread_context_ip	INTEGER	The instruction pointer at the moment the syscall was made.
event_user_thread_context_ip_in_native_ntdll	BOOLEAN	Indicates whether or not the IP in the trapframe when in the middle of a syscall was pointing to ntdll.
event_user_thread_context_is_heavens_gate	BOOLEAN	Indicates whether or not the user stack pointer is not inside the x64 stack limits, but was inside the x86 stack limits for a wow64 process.
event_user_thread_context_is_stack_pivot	BOOLEAN	Indicates whether or not the RSP in the trapframe was not inside the thread stack limits.
event_user_thread_context_sp	INTEGER	The stack pointer at the moment the syscall was made.
event_utc_diff_minutes	INTEGER	The difference in minutes of the original timestamp from UTC.
event_validity_enum	INTEGER	<p>An enum set by the preprocessor when detecting that an event is invalid: 1 - valid 2 - invalid due to future timestamp field. 3 - invalid due to an "old" timestamp field that exceeds the host's boot time.</p>
event_version	INTEGER	Version of the event structure, where each change increases the version.
event_versions	INTEGER	Event version for this event.
execution_actor_causality_id	STRING	Causality ID of the parent which executed the terminated process instance.
execution_actor_instance_id	STRING	Instance ID of the parent which executed the terminated process instance.
facility	STRING
file_data
fw_dst_normalized_user	RECORD	Normalized user information.
fw_identities	RECORD	DEPRECATED
fw_is_dup_log	INTEGER
fw_log_subtypes	STRING
fw_log_types	STRING
fw_src_normalized_user	RECORD	Normalized user information.
fw_time_generated	INTEGER	Equivalent to the event_timestamp.
fw_traffic_flags	INTEGER	Protocol traffic flags as seen on the Next-Generation Firewall (NGFW).
generatedTime	TIMESTAMP	Equivalent to the event_timestamp.
global_protect_data
hardware_id	STRING	Unique identifier GlobalProtect assigned to the host.
host_metadata_domain	STRING	Domain of the host.
host_metadata_hostname	STRING
Hostname
host_metadata_interface_map	RECORD	Agent interface maps (IPs and Mac).
http_content_type	STRING	Content-type header of the HTTP traffic.
http_data	RECORD	HTTP log data.
http_data_is_trimmed	BOOLEAN	Indicates whether the HTTP data was too long that it was trimmed by the Next-Generation Firewall (NGFW).
http_method	STRING	<p>0 = UNKNOWN_METHOD 1 = GET 2 = POST 3 = CONNECT 4 = HEAD 5 = PUT 6 = DELETE 7 = OPTIONS</p>
http_referer	STRING	HTTP Referer header.
http_req_before_method	STRING
http_req_content_type_header	STRING	HTTP content type header.
http_req_host_header	STRING	HTTP host header.
http_req_referer_header	STRING	HTTP Referer header.
http_req_uri	STRING	HTTP request URI.
http_req_user_agent_header	STRING	HTTP user agent header.
http_rsp_code	INTEGER	HTTP response code.
http_rsp_content_type_header	STRING	HTTP response content type header.
http_rsp_filename	STRING	HTTP response filename.
http_server	STRING	HTTP server
http_status_code	INTEGER	HTTP status code.
hwnd	INTEGER	The foreground window.
icmp_code	INTEGER	ICMP protocol request code.
icmp_original_length	INTEGER	Internet Control Message Protocol (ICMP) payload length.
icmp_type	INTEGER	ICMP protocol request type.
insert_timestamp	TIMESTAMP	Ingestion timestamp
is_disintegrated	BOOLEAN	Indicates whether or not the story was disintegrated.
is_internal_ip	BOOLEAN	Indicates whether or not the source IP is outside the private range.
krb_tgs_data	RECORD	Kerberos Ticket Granting Service (TGS) log data.
krb_tgt_data	RECORD	Kerberos Ticket Granting Service (TGS) log data.
ldap_data	RECORD	LDAP log data.
login_data	RECORD	Windows Event Log login data.
login_data_dst_normalized_user	RECORD	Destination user CIE resolution information.
login_data_dst_outbound_normalized_user	RECORD	Destination outbound user DSS resolution information.
login_data_src_normalized_user	RECORD	Source user CIE resolution information.
non_standard_dport	INTEGER	This field is a boolean represented as an Integer. Indicates whether or not the destination port is a non-standard port based on Next-Generation Firewall (NGFW) logic
ntlm_auth_data	RECORD	NTLM log data.
one_login_data
other_json	DEPRECATED
packet	STRING	<p>Packet payload excluding TCP/IP header. Only valid for event_sub_type = 17 (raw_data)</p>
related_alerts
serverTime	TIMESTAMP	Timestamp of the event displayed on the server side.
ssl_data	RECORD	SSL log data.
ssl_req_chello_sni_sample	STRING	SNI domain obtained from SSL protocol parsing.
sso_debug_data	STRING	Okta debug info, which includes protocol informaiton, URIs, and more.
sso_display_message	STRING	Single Sign-on (SSO) event description.
sso_event_type	INTEGER	Single Sign-On (SSO) event type as obtained by the original SSO provider.
sso_severity	STRING	Severity as reported: DEBUG, INFO, WARN, ERROR
story_id	STRING	ID of the story.
story_id_original	DEPRECATED
story_publish_timestamp	INTEGER	Story publishing timestamp in epoch time.
story_version	FLOAT	Story version
syscall_action_etw_based	BOOLEAN	Indicates whether or not the syscall collected is from Windows ETW.
syscall_action_int_params	STRING	Integer parameters from syscalls in a JSON format.
syscall_action_stack_ptr	STRING
syscall_action_string_params	STRING	String parameters from syscalls in a JSON format.
tcp_flags	INTEGER	TCP Flags
title	STRING	Title of top_level_hwnd.
top_level_hwnd	INTEGER	The top level window of the foreground window.
trapsId	STRING	DEPRECATED
ttl	INTEGER	IP Protocol time-to-live (TTL) obtained from the source.
tunnel_type	STRING	The type of tunnel.
uri	STRING	Threat URI
user_generic_value1	INTEGER	<p>A bitmap that can be set in the YAML. The first bit indicates whether an operation is in the GUI or not.</p>
user_generic_value2	INTEGER	<p>An integer that can be set in the YAML. It is used to indicate Yara rule IDs for windows web shells.</p>
user_id	STRING	<p>Windows: User SID Unix: UID</p>
uuid	STRING	Equivalent to the 'event_id'.
vendor	STRING	Log vendor
vpn_event_description	STRING	The name of the GlobalProtect event.
vpn_server	STRING	VPN server name or IP.
vpn_service	STRING	VPN service name.
xdr_pro_lite	BOOLEAN	Indicates whether or not the agent is XDRProNG and sends fewer events.
zip_id	STRING	DEPRECATED
zscaler_vpn_data