mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-24 18:03:10 +01:00
3460 lines
69 KiB
JSON
3460 lines
69 KiB
JSON
{
|
|
"index_patterns": ["logstash-ids-*", "logstash-firewall-*", "logstash-syslog-*", "logstash-bro-*", "logstash-import-*"],
|
|
"version":50001,
|
|
"order" : 0,
|
|
"settings":{
|
|
"number_of_replicas":0,
|
|
"number_of_shards":1,
|
|
"index.refresh_interval":"30s"
|
|
},
|
|
"mappings":{
|
|
"doc":{
|
|
"dynamic": false,
|
|
"date_detection": false,
|
|
"properties":{
|
|
"@timestamp":{
|
|
"type":"date"
|
|
},
|
|
"@version":{
|
|
"type":"keyword"
|
|
},
|
|
"geoip":{
|
|
"dynamic":true,
|
|
"properties":{
|
|
"ip":{
|
|
"type":"ip"
|
|
},
|
|
"location":{
|
|
"type":"geo_point"
|
|
},
|
|
"latitude":{
|
|
"type":"half_float"
|
|
},
|
|
"longitude":{
|
|
"type":"half_float"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo":{
|
|
"dynamic":true,
|
|
"properties":{
|
|
"ip":{
|
|
"type":"ip"
|
|
},
|
|
"location":{
|
|
"type":"geo_point"
|
|
},
|
|
"latitude":{
|
|
"type":"half_float"
|
|
},
|
|
"longitude":{
|
|
"type":"half_float"
|
|
}
|
|
}
|
|
},
|
|
"source_geo":{
|
|
"dynamic":true,
|
|
"properties":{
|
|
"ip":{
|
|
"type":"ip"
|
|
},
|
|
"location":{
|
|
"type":"geo_point"
|
|
},
|
|
"latitude":{
|
|
"type":"half_float"
|
|
},
|
|
"longitude":{
|
|
"type":"half_float"
|
|
}
|
|
}
|
|
},
|
|
"signature_info":{
|
|
"type":"keyword"
|
|
},
|
|
"aa":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ack":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"action":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"additional_info":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"age":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"alert":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"alert_level":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"analyzer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"answers":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"assigned_ip":{
|
|
"type":"ip",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"auth":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"authentication_attempts":{
|
|
"type":"long"
|
|
},
|
|
"authentication_method":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"authentication_success":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"basic_constraints":{
|
|
"type":"object",
|
|
"properties":{
|
|
"path_len": {
|
|
"type": "text"
|
|
}
|
|
}
|
|
},
|
|
"basic_constraints_ca":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"basic_constraints_path_length":{
|
|
"type":"long"
|
|
},
|
|
"bound_port":{
|
|
"type":"long"
|
|
},
|
|
"call_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"category":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"cc":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_chain_count":{
|
|
"type":"long"
|
|
},
|
|
"certificate_chain_fuids":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_common_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_common_name_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"certificate_common_name_length":{
|
|
"type":"long"
|
|
},
|
|
"certificate_count":{
|
|
"type":"long"
|
|
},
|
|
"certificate_country_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_curve":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_exponent":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_issuer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_key_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_key_length":{
|
|
"type":"long"
|
|
},
|
|
"certificate_key_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_locality":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_not_valid_after":{
|
|
"type":"date"
|
|
},
|
|
"certificate_not_valid_before":{
|
|
"type":"date"
|
|
},
|
|
"certificate_number_days_valid":{
|
|
"type":"long"
|
|
},
|
|
"certificate_organization":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_organization_unit":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_permanent":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_serial":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_serial_number":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_signing_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_state":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_subject":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"certificate_version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"checksum":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"cipher":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"cipher_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"class":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"classification":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_build":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_certificate_chain_fuids":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_certificate_subject":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_certificate_fuid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_digital_product_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_issuer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_major_version":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_minor_version":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"client_subject":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"command":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"community":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"company":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"compile_ts":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"compression_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"connect_info":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"connection_state":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"connection_state_description":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"content_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"cookie":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"creation_date":{
|
|
"type":"date"
|
|
},
|
|
"creation_time":{
|
|
"type":"date"
|
|
},
|
|
"current_directory":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"curve":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"data_channel_destination_ip":{
|
|
"type":"ip"
|
|
},
|
|
"data_channel_destination_port":{
|
|
"type":"long"
|
|
},
|
|
"data_channel_passive":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"data_channel_source_ip":{
|
|
"type":"ip"
|
|
},
|
|
"data_length":{
|
|
"type":"long"
|
|
},
|
|
"date":{
|
|
"type":"text"
|
|
},
|
|
"dcc_file_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"dcc_file_size":{
|
|
"type":"long"
|
|
},
|
|
"dcc_mime_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"depth":{
|
|
"type":"long"
|
|
},
|
|
"description":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"desktop_height":{
|
|
"type":"long"
|
|
},
|
|
"desktop_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"desktop_width":{
|
|
"type":"long"
|
|
},
|
|
"dest_is_ipv6":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_city":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.city_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.continent_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.dma_code":{
|
|
"type":"long"
|
|
},
|
|
"destination_geo.ip":{
|
|
"type":"ip"
|
|
},
|
|
"destination_geo.latitude":{
|
|
"type":"long"
|
|
},
|
|
"destination_geo.location":{
|
|
"type":"geo_point"
|
|
},
|
|
"destination_geo.longitude":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.postal_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.region_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.country_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.region_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_geo.timezone":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_hostname":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_ip":{
|
|
"type":"ip"
|
|
},
|
|
"destination_ips":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_latitude":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_longitude":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_port":{
|
|
"type":"long"
|
|
},
|
|
"destination_port_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination_region":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"details":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"dir":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"direction":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"display_string":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"domain_age":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"domain_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"dropped":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"duration":{
|
|
"type":"long"
|
|
},
|
|
"valid_from":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"enabled":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"encryption_level":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"encryption_method":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"endpoint":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"entry":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"entry_location":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"error_message":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"escalated_user":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"established":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"event_id":{
|
|
"type":"long"
|
|
},
|
|
"event_timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"event_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"exception":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"extracted":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"extracted_cutoff":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"facility":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"fc_reply":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"fc_request":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"file_description":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"file_ip":{
|
|
"type":"ip",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"file_mime_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"file_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"file_size":{
|
|
"type":"long"
|
|
},
|
|
"first_received":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"flow_label":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"forwardable":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"framed_addr":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"freq_virtual_host":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"frequency_scores":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"from":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ftp_argument":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ftp_command":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"fuid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"fuids":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"function":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"geoip.ip":{
|
|
"type":"ip"
|
|
},
|
|
"geoip.latitude":{
|
|
"type":"long"
|
|
},
|
|
"geoip.location":{
|
|
"type":"geo_point"
|
|
},
|
|
"geoip.longitude":{
|
|
"type":"long"
|
|
},
|
|
"get_bulk_requests":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"get_requests":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"get_responses":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"gid":{
|
|
"type":"long"
|
|
},
|
|
"has_cert_table":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"has_debug_data":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"has_export_table":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"has_import_table":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"height":{
|
|
"type":"long"
|
|
},
|
|
"helo":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"highest_registered_domain":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"highest_registered_domain_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"history":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"hop_limit":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"host":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"host_key":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"host_key_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"hostname":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"iin":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"image_path":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"in_reply_to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"indicator":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"indicator_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"info_code":{
|
|
"type":"long"
|
|
},
|
|
"info_message":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"initiated":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"integrity_level":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"interface":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ip_version":{
|
|
"type":"long"
|
|
},
|
|
"ipv4_ecn":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ips":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_flags":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_offset":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_protocol":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_protocol_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_protocol_length":{
|
|
"type":"long"
|
|
},
|
|
"ipv4_tos":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ipv4_ttl":{
|
|
"type":"long"
|
|
},
|
|
"irc_command":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"irc_username":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"is_64bit":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"is_exe":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"is_orig":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"is_source_ipv6":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"is_webmail":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_common_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_common_name_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"issuer_common_name_length":{
|
|
"type":"long"
|
|
},
|
|
"issuer_country_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_distinguished_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_locality":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_organization":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_organization_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"issuer_organization_unit":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_serial_number":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"issuer_state":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"kerberos_success":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"kex_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"keyboard_layout":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"last_alert":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"last_reply":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"launch_string":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"lease_time":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"length":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"local_orig":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"local_respond":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"location":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"log_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"log_timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"logged":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"logon_guid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"logon_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"logstash_time":{
|
|
"type":"long"
|
|
},
|
|
"mac":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mac_algorithm":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"machine":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mail_date":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mail_from":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"matched":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"md5":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"message":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"message_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"method":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mimetype":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"missed_bytes":{
|
|
"type":"long"
|
|
},
|
|
"missing_bytes":{
|
|
"type":"long"
|
|
},
|
|
"msg":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mysql_argument":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mysql_command":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"mysql_success":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"n":{
|
|
"type":"long"
|
|
},
|
|
"name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"named_pipe":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"native_file_system":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"next_protocol":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"nick":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"note":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"notice":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ntlm_success":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"num_packets":{
|
|
"type":"long"
|
|
},
|
|
"object_size":{
|
|
"type":"long"
|
|
},
|
|
"operation":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"options":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"orig_filenames":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"orig_fuids":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"orig_mime_types":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"original_bytes":{
|
|
"type":"long"
|
|
},
|
|
"original_country_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"original_ip_bytes":{
|
|
"type":"long"
|
|
},
|
|
"original_packets":{
|
|
"type":"long"
|
|
},
|
|
"os":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ossec_agent_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ossec_timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"overflow_bytes":{
|
|
"type":"long"
|
|
},
|
|
"p":{
|
|
"type":"long"
|
|
},
|
|
"parent_domain":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"parent_domain_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"parent_domain_length":{
|
|
"type":"long"
|
|
},
|
|
"parent_image_path":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"parent_process_guid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"parent_process_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"parent_process_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"password":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"path":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"peer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"peer_description":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"pesha1":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"pesha256":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"pid":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"port":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"prev_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"priority":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"process":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"process_arguments":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"process_guid":{
|
|
"type":"long"
|
|
},
|
|
"process_id":{
|
|
"type":"long",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"process_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"profile":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"program":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"protocol":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"protocol_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"protocol_version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"proxied":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"query":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"query_class":{
|
|
"type":"long"
|
|
},
|
|
"query_class_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"query_length":{
|
|
"type":"long"
|
|
},
|
|
"query_type":{
|
|
"type":"long"
|
|
},
|
|
"query_type_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"ra":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rcode":{
|
|
"type":"long"
|
|
},
|
|
"rcode_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rd":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"reason":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"recipient_to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"referrer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rejected":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"remote_ip":{
|
|
"type":"ip"
|
|
},
|
|
"remote_location":{
|
|
"type":"object",
|
|
"properties":{
|
|
"country_code": {
|
|
"type": "text"
|
|
}
|
|
}
|
|
},
|
|
"renewable":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"reply_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"reply_message":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"reply_to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"request_body_len":{
|
|
"type":"long"
|
|
},
|
|
"request_body_length":{
|
|
"type":"long"
|
|
},
|
|
"request_from":{
|
|
"type":"text"
|
|
},
|
|
"request_path":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"request_port":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"request_timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"request_to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"request_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"requested_color_depth":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"requested_resource":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"resp_filenames":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"resp_fuids":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"resp_mime_types":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"respond_bytes":{
|
|
"type":"long"
|
|
},
|
|
"respond_country_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"respond_ip_bytes":{
|
|
"type":"long"
|
|
},
|
|
"respond_packets":{
|
|
"type":"long"
|
|
},
|
|
"response":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"response_body_len":{
|
|
"type":"long"
|
|
},
|
|
"response_body_length":{
|
|
"type":"long"
|
|
},
|
|
"response_from":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"response_path":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"response_to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"result":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"resumed":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rev":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rig":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rows":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rtt":{
|
|
"type":"float",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rule":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"rule_number":{
|
|
"type":"long"
|
|
},
|
|
"rule_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"san_dns":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"second_received":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"section_names":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"security_protocol":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"seen_bytes":{
|
|
"type":"long"
|
|
},
|
|
"seen_node":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"seen_where":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sensor_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"seq":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sequence_number":{
|
|
"type":"long"
|
|
},
|
|
"server":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_certificate_fuid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_certificate_subject":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_major_version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_minor_version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"server_name_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"server_name_length":{
|
|
"type":"long"
|
|
},
|
|
"service":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"set_requests":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"severity":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sha1":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sha256":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"share_flag":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"share_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sid":{
|
|
"type":"long"
|
|
},
|
|
"signer":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"site":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"size":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"software_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.city_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.continent_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.dma_code":{
|
|
"type":"long"
|
|
},
|
|
"source_geo.ip":{
|
|
"type":"ip"
|
|
},
|
|
"source_geo.latitude":{
|
|
"type":"long"
|
|
},
|
|
"source_geo.location":{
|
|
"type":"geo_point"
|
|
},
|
|
"source_geo.longitude":{
|
|
"type":"long"
|
|
},
|
|
"source_geo.postal_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.region_code":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.region_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_geo.timezone":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_hostname":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_ip":{
|
|
"type":"ip"
|
|
},
|
|
"source_ips":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"source_port":{
|
|
"type":"long"
|
|
},
|
|
"source_port_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sources":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"status":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"status_code":{
|
|
"type":"long"
|
|
},
|
|
"status_message":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"status_msg":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sub_msg":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sub_rule_number":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"subdomain":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"subdomain_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"subdomain_length":{
|
|
"type":"long"
|
|
},
|
|
"subject":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"subsystem":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"suppress_for":{
|
|
"type":"long"
|
|
},
|
|
"syslog-facility":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-file_name":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-host":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-host_from":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-legacy_msghdr":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-pid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-priority":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"syslog-sourceip":{
|
|
"type":"ip"
|
|
},
|
|
"syslog-tags":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"sysmon_timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tags":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"target_filename":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tc":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tcp_flags":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"terminal_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"valid_till":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
|
|
"timed_out":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"times_accessed":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"times_changed":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"times_created":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"times_modified":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"timestamp":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tld.subdomain":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tls":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"to":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"top_level_domain":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"total_bytes":{
|
|
"type":"long"
|
|
},
|
|
"tracker_id":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"trans_depth":{
|
|
"type":"long"
|
|
},
|
|
"transaction_id":{
|
|
"type":"long"
|
|
},
|
|
"ttls":{
|
|
"type":"text"
|
|
},
|
|
"tty":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tunnel_parents":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"tunnel_type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"type":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uid":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"unparsed_version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"up_since":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"urg":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uri":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uri_length":{
|
|
"type":"long"
|
|
},
|
|
"username":{
|
|
"type":"text",
|
|
"fields": {
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"user_agent":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"useragent":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"useragent_length":{
|
|
"type":"long"
|
|
},
|
|
"uses_aslr":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uses_code_integrity":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uses_dep":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"uses_seh":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"validation_status":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"value":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version_additional_info":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version_major":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version_minor":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version_minor2":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"version_minor3":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"virtual_host":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"virtual_host_frequency_score":{
|
|
"type":"long"
|
|
},
|
|
"virtual_host_length":{
|
|
"type":"long"
|
|
},
|
|
"warning":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"width":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"window":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
},
|
|
"x_originating_ip":{
|
|
"type":"ip"
|
|
},
|
|
"year":{
|
|
"type":"long"
|
|
},
|
|
"z":{
|
|
"type":"text",
|
|
"fields":{
|
|
"keyword":{
|
|
"type":"keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|