Details
| ID | Corelight_Zeek_ModelingRule |
|---|---|
| From Version | 8.15.0 |
Schema
corelight_zeek_raw
| Field | Type | Array? |
|---|---|---|
_path |
string | — |
_system_name |
string | — |
answers |
string | — |
cipher |
string | — |
client |
string | — |
conn_state |
string | — |
domainname |
string | — |
duration |
string | — |
endpoint |
string | — |
facility |
string | — |
host |
string | — |
hostname |
string | — |
id |
string | — |
id_orig_h |
string | — |
id_orig_p |
string | — |
id_resp_h |
string | — |
id_resp_p |
string | — |
message |
string | — |
method |
string | — |
named_pipe |
string | — |
operation |
string | — |
orig_bytes |
string | — |
orig_pkts |
string | — |
origin |
string | — |
proto |
string | — |
qtype_name |
string | — |
query |
string | — |
rcode |
int | — |
rcode_name |
string | — |
referrer |
string | — |
rejected |
boolean | — |
request_body_len |
string | — |
request_type |
string | — |
resp_bytes |
string | — |
resp_pkts |
string | — |
response_body_len |
string | — |
rtt |
string | — |
server_dns_computer_name |
string | — |
server_tree_name |
string | — |
service |
string | — |
severity |
string | — |
status_code |
int | — |
success |
boolean | — |
tags |
string | — |
trans_id |
string | — |
ts |
string | — |
uid |
string | — |
uri |
string | — |
user_agent |
string | — |
username |
string | — |
version |
string | — |