Skip to main content

SentinelOne

Overview​

AlphaSOC normalizes SentinelOne telemetry into the Open Cybersecurity Schema Framework (OCSF) format. The fields listed below are available for use in Sigma detection rules. For complete field definitions and semantics, refer to the linked OCSF class schema pages.

SentinelOne: Authentication​

OCSF Category: Identity & Access Management

OCSF Class: Authentication

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • actor.user.domain
  • actor.user.name
  • actor.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • dst_endpoint.hostname
  • is_remote
  • logon_type
  • logon_type_id
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • session.uid
  • severity
  • severity_id
  • src_endpoint.ip
  • status
  • status_detail
  • status_id
  • time
  • time_dt
  • type_name
  • type_uid
  • user.domain
  • user.name
  • user.type
  • user.type_id
  • user.uid

SentinelOne: Cross Process Activity​

OCSF Category: System Activity

OCSF Class: Process Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • process.cmd_line
  • process.created_time
  • process.file.company_name
  • process.file.desc
  • process.file.ext
  • process.file.hashes[]
  • process.file.hashes[].algorithm_id
  • process.file.hashes[].value
  • process.file.internal_name
  • process.file.name
  • process.file.path
  • process.file.product.name
  • process.file.product.version
  • process.file.signature.algorithm
  • process.file.signature.algorithm_id
  • process.file.signature.state
  • process.file.signature.state_id
  • process.file.size
  • process.integrity
  • process.integrity_id
  • process.name
  • process.pid
  • process.session.uid
  • process.user.name
  • process.user.uid
  • requested_permissions
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: File System Activity​

OCSF Category: System Activity

OCSF Class: File System Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • file.company_name
  • file.created_time
  • file.desc
  • file.ext
  • file.hashes[]
  • file.hashes[].algorithm_id
  • file.hashes[].value
  • file.internal_name
  • file.modified_time
  • file.name
  • file.path
  • file.product.name
  • file.product.version
  • file.signature.algorithm
  • file.signature.algorithm_id
  • file.signature.state
  • file.signature.state_id
  • file.size
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: HTTP Activity​

OCSF Category: Network Activity

OCSF Class: HTTP Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • dst_endpoint.ip
  • http_request.http_method
  • http_request.referrer
  • http_request.url.hostname
  • http_request.url.path
  • http_request.url.scheme
  • http_request.url.url_string
  • http_request.user_agent
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: Kernel Extension Activity​

OCSF Category: System Activity

OCSF Class: Kernel Extension Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • driver.file.company_name
  • driver.file.created_time
  • driver.file.desc
  • driver.file.ext
  • driver.file.hashes[]
  • driver.file.hashes[].algorithm_id
  • driver.file.hashes[].value
  • driver.file.internal_name
  • driver.file.modified_time
  • driver.file.name
  • driver.file.path
  • driver.file.product.name
  • driver.file.product.version
  • driver.file.signature.algorithm
  • driver.file.signature.algorithm_id
  • driver.file.signature.state
  • driver.file.signature.state_id
  • driver.file.size
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: Module Activity​

OCSF Category: System Activity

OCSF Class: Module Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • module.file.company_name
  • module.file.created_time
  • module.file.desc
  • module.file.ext
  • module.file.hashes[]
  • module.file.hashes[].algorithm_id
  • module.file.hashes[].value
  • module.file.internal_name
  • module.file.modified_time
  • module.file.name
  • module.file.path
  • module.file.product.name
  • module.file.product.version
  • module.file.signature.algorithm
  • module.file.signature.algorithm_id
  • module.file.signature.state
  • module.file.signature.state_id
  • module.file.size
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: Process Activity​

OCSF Category: System Activity

OCSF Class: Process Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • process.cmd_line
  • process.created_time
  • process.file.company_name
  • process.file.desc
  • process.file.ext
  • process.file.hashes[]
  • process.file.hashes[].algorithm_id
  • process.file.hashes[].value
  • process.file.internal_name
  • process.file.name
  • process.file.path
  • process.file.product.name
  • process.file.product.version
  • process.file.signature.algorithm
  • process.file.signature.algorithm_id
  • process.file.signature.state
  • process.file.signature.state_id
  • process.file.size
  • process.integrity
  • process.integrity_id
  • process.name
  • process.pid
  • process.session.uid
  • process.user.name
  • process.user.uid
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: Scheduled Job Activity​

OCSF Category: System Activity

OCSF Class: Scheduled Job Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • job.file.name
  • job.file.path
  • job.name
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

SentinelOne: Script Activity​

OCSF Category: System Activity

OCSF Class: Script Activity

OCSF Fields

  • activity_id
  • activity_name
  • actor.process.cmd_line
  • actor.process.created_time
  • actor.process.file.company_name
  • actor.process.file.desc
  • actor.process.file.ext
  • actor.process.file.hashes[]
  • actor.process.file.hashes[].algorithm_id
  • actor.process.file.hashes[].value
  • actor.process.file.internal_name
  • actor.process.file.name
  • actor.process.file.path
  • actor.process.file.product.name
  • actor.process.file.product.version
  • actor.process.file.signature.algorithm
  • actor.process.file.signature.algorithm_id
  • actor.process.file.signature.state
  • actor.process.file.signature.state_id
  • actor.process.file.size
  • actor.process.integrity
  • actor.process.integrity_id
  • actor.process.name
  • actor.process.parent_process.cmd_line
  • actor.process.parent_process.created_time
  • actor.process.parent_process.file.company_name
  • actor.process.parent_process.file.desc
  • actor.process.parent_process.file.ext
  • actor.process.parent_process.file.hashes[]
  • actor.process.parent_process.file.hashes[].algorithm_id
  • actor.process.parent_process.file.hashes[].value
  • actor.process.parent_process.file.internal_name
  • actor.process.parent_process.file.name
  • actor.process.parent_process.file.path
  • actor.process.parent_process.file.product.name
  • actor.process.parent_process.file.product.version
  • actor.process.parent_process.file.signature.algorithm
  • actor.process.parent_process.file.signature.algorithm_id
  • actor.process.parent_process.file.signature.state
  • actor.process.parent_process.file.signature.state_id
  • actor.process.parent_process.file.size
  • actor.process.parent_process.integrity
  • actor.process.parent_process.integrity_id
  • actor.process.parent_process.name
  • actor.process.parent_process.pid
  • actor.process.parent_process.session.uid
  • actor.process.parent_process.user.name
  • actor.process.parent_process.user.uid
  • actor.process.pid
  • actor.process.session.uid
  • actor.process.user.name
  • actor.process.user.uid
  • category_name
  • category_uid
  • class_name
  • class_uid
  • count
  • device.hostname
  • device.ip
  • device.mac
  • device.os.name
  • device.os.type
  • device.os.type_id
  • device.uid
  • metadata.event_code
  • metadata.product.name
  • metadata.product.vendor_name
  • metadata.product.version
  • metadata.profiles[]
  • metadata.tenant_uid
  • metadata.uid
  • metadata.version
  • script.hashes[]
  • script.hashes[].algorithm_id
  • script.hashes[].value
  • script.script_content.is_truncated
  • script.script_content.untruncated_size
  • script.script_content.value
  • script.type
  • script.type_id
  • severity
  • severity_id
  • time
  • time_dt
  • type_name
  • type_uid

Further Reading​