OpenIOC search terms supported by the xAgent

The following table lists the descriptions, types, and OpenIOC search terms supported by Endpoint Security (HX) xAgent release 35.31.0. These terms can be used with the /hx/api/v3/searches endpoint. See the Endpoint Security REST API Guide for more information.

Agent App Creation Date— date
AgentInfo/appCreated
Agent App Start Date— date
AgentInfo/appStarted
Agent App Version— string
AgentInfo/appVersion
Agent Config Channel— string
AgentInfo/configChannel
Agent Config ETag— string
AgentInfo/configETag
Agent Config ID— string
AgentInfo/configId
Agent Containment State— string
AgentInfo/containmentState
Agent Containment Whitelist IP— IP
AgentInfo/containmentWhitelistArray/ip/ip
Agent ExD Status— string
AgentInfo/exdStatus
Agent Intel ETag— string
AgentInfo/intelETag
Agent Intel Hash— md5
AgentInfo/intelHash
State Agent Status— string
AgentInfo/stateAgentStatus
ARP Cache Type— string
ArpEntryItem/CacheType
ARP IPv4 Address— IP
ArpEntryItem/IPv4Address
ARP IPv6 Address— IP
ArpEntryItem/IPv6Address
ARP Interface— IP
ArpEntryItem/Interface
ARP Interface Type— IP
ArpEntryItem/InterfaceType
ARP Is Router— bool
ArpEntryItem/IsRouter
ARP Last Reachable— date
ArpEntryItem/LastReachable
ARP Last Unreachable— date
ArpEntryItem/LastUnreachable
ARP Physical Address— string
ArpEntryItem/PhysicalAddress
ARP State— string
ArpEntryItem/State
Config Key— string
ConfigItem/key
Config Value— string
ConfigItem/val
CookieHistory Browser Name— string
CookieHistoryItem/BrowserName
CookieHistory Browser Version— string
CookieHistoryItem/BrowserVersion
CookieHistory Cookie Flags— string
CookieHistoryItem/CookieFlags
CookieHistory Cookie Name— string
CookieHistoryItem/CookieName
CookieHistory Cookie Path— string
CookieHistoryItem/CookiePath
CookieHistory Cookie Value— string
CookieHistoryItem/CookieValue
CookieHistory Creation Date— date
CookieHistoryItem/CreationDate
CookieHistory Expiration Date— date
CookieHistoryItem/ExpirationDate
CookieHistory File Name— string
CookieHistoryItem/FileName
CookieHistory File Path— string
CookieHistoryItem/FilePath
CookieHistory Host Name— string
CookieHistoryItem/HostName
CookieHistory IsHttpOnly— string
CookieHistoryItem/IsHttpOnly
CookieHistory IsSecure— bool
CookieHistoryItem/IsSecure
CookieHistory Last Accessed Date— date
CookieHistoryItem/LastAccessedDate
CookieHistory Last Modified Date— date
CookieHistoryItem/LastModifiedDate
CookieHistory Profile— string
CookieHistoryItem/Profile
CookieHistory Username— string
CookieHistoryItem/Username
Disk Name— string
DiskItem/DiskName
Disk Size— int
DiskItem/DiskSize
Disk Partition Length— int
DiskItem/PartitionList/Partition/PartitionLength
Disk Partition Number— int
DiskItem/PartitionList/Partition/PartitionNumber
Disk Partition Offset— int
DiskItem/PartitionList/Partition/PartitionOffset
Disk Partition Type— string
DiskItem/PartitionList/Partition/PartitionType
DNS Data Length— int
DnsEntryItem/DataLength
DNS Flags— string
DnsEntryItem/Flags
DNS Host— string
DnsEntryItem/Host
DNS Record Data ATM Address— string
DnsEntryItem/RecordData/ATMAddress
DNS Record Data Address Type— string
DnsEntryItem/RecordData/AddressType
DNS Record Data Administrator Name— string
DnsEntryItem/RecordData/AdministratorName
DNS Record Data Algorithm— string
DnsEntryItem/RecordData/Algorithm
DNS Record Data Bitmask— int
DnsEntryItem/RecordData/Bitmask
DNS Record Data Blob— string
DnsEntryItem/RecordData/Blob
DNS Record Data Cache Timeout— date
DnsEntryItem/RecordData/CacheTimeout
DNS Record Data Creation Date— date
DnsEntryItem/RecordData/CreationDate
DNS Record Data Date Signed— date
DnsEntryItem/RecordData/DateSigned
DNS Record Data Default Time To Live— date
DnsEntryItem/RecordData/DefaultTimeToLive
DNS Record Data Digest— string
DnsEntryItem/RecordData/Digest
DNS Record Data Digest Length— int
DnsEntryItem/RecordData/DigestLength
DNS Record Data Digest Type— string
DnsEntryItem/RecordData/DigestType
DNS Record Data Error— string
DnsEntryItem/RecordData/Error
DNS Record Data Expiration Date— date
DnsEntryItem/RecordData/ExpirationDate
DNS Record Data Expire— date
DnsEntryItem/RecordData/Expire
DNS Record Data Fudge Time— int
DnsEntryItem/RecordData/FudgeTime
DNS Record Data Host— string
DnsEntryItem/RecordData/Host
DNS Record Data IPv4 Address— IP
DnsEntryItem/RecordData/IPv4Address
DNS Record Data IPv6 Address— IP
DnsEntryItem/RecordData/IPv6Address
DNS Record Data Key— string
DnsEntryItem/RecordData/Key
DNS Record Data Key Flags— int
DnsEntryItem/RecordData/KeyFlags
DNS Record Data Key Length— int
DnsEntryItem/RecordData/KeyLength
DNS Record Data Key Name— string
DnsEntryItem/RecordData/KeyName
DNS Record Data Key Tag— int
DnsEntryItem/RecordData/KeyTag
DNS Record Data Label Count— int
DnsEntryItem/RecordData/LabelCount
DNS Record Data Lookup Timeout— date
DnsEntryItem/RecordData/LookupTimeout
DNS Record Data Mailbox Errors Name— string
DnsEntryItem/RecordData/MailboxErrorsName
DNS Record Data Mailbox Name— string
DnsEntryItem/RecordData/MailboxName
DNS Record Data Mapping Flag— string
DnsEntryItem/RecordData/MappingFlag
DNS Record Data Mode— string
DnsEntryItem/RecordData/Mode
DNS Record Data MX Host— string
DnsEntryItem/RecordData/MxHost
DNS Record Data Next Host— string
DnsEntryItem/RecordData/NextHost
DNS Record Data Order— int
DnsEntryItem/RecordData/Order
DNS Record Data Original Time To Live— date
DnsEntryItem/RecordData/OriginalTimeToLive
DNS Record Data Original Xid— int
DnsEntryItem/RecordData/OriginalXid
DNS Record Data Port— int
DnsEntryItem/RecordData/Port
DNS Record Data Preference— int
DnsEntryItem/RecordData/Preference
DNS Record Data Primary Server Name— string
DnsEntryItem/RecordData/PrimaryServerName
DNS Record Data Priority— int
DnsEntryItem/RecordData/Priority
DNS Record Data Protocol— string
DnsEntryItem/RecordData/Protocol
DNS Record Data Public Key— string
DnsEntryItem/RecordData/PublicKey
DNS Record Data Refresh— date
DnsEntryItem/RecordData/Refresh
DNS Record Data Regular Expression— string
DnsEntryItem/RecordData/RegularExpression
DNS Record Data Replacement — string
DnsEntryItem/RecordData/Replacement
DNS Record Data Retry— date
DnsEntryItem/RecordData/Retry
DNS Record Data Serial Number— int
DnsEntryItem/RecordData/SerialNumber
DNS Record Data Services— string
DnsEntryItem/RecordData/Services
DNS Record Data Signature— string
DnsEntryItem/RecordData/Signature
DNS Record Data Signature Length— int
DnsEntryItem/RecordData/SignatureLength
DNS Record Data Signer— string
DnsEntryItem/RecordData/Signer
DNS Record Data String— string
DnsEntryItem/RecordData/String
DNS Record Data Target Host — string
DnsEntryItem/RecordData/TargetHost
DNS Record Data Type— string
DnsEntryItem/RecordData/Type
DNS Record Data Type Covered— string
DnsEntryItem/RecordData/TypeCovered
DNS Record Data Weight— int
DnsEntryItem/RecordData/Weight
DNS Record Data WINS Server IPv4 Address— IP
DnsEntryItem/RecordData/WinsServerIPv4Address
DNS Record Name— string
DnsEntryItem/RecordName
DNS Record Type— string
DnsEntryItem/RecordType
DNS Time To Live— string
DnsEntryItem/TimeToLive
Driver Certificate Issuer— string
DriverItem/CertificateIssuer
Driver Certificate Subject— string
DriverItem/CertificateSubject
Driver Attached Device Name— string
DriverItem/DeviceItem/AttachedDeviceName
Driver Attached Device Object— int
DriverItem/DeviceItem/AttachedDeviceObject
Driver Attached Driver Name — string
DriverItem/DeviceItem/AttachedDriverName
Driver Attached Driver Object— int
DriverItem/DeviceItem/AttachedDriverObject
Driver Attached To Device Name— string
DriverItem/DeviceItem/AttachedToDeviceName
Driver Attached To Device Object— int
DriverItem/DeviceItem/AttachedToDeviceObject
Driver Attached To Driver Name— string
DriverItem/DeviceItem/AttachedToDriverName
Driver Attached To Driver Object— int
DriverItem/DeviceItem/AttachedToDriverObject
Driver Device Name— string
DriverItem/DeviceItem/DeviceName
Driver Device Object— int
DriverItem/DeviceItem/DeviceObject
Driver Device Driver Name— string
DriverItem/DeviceItem/DriverName
Driver Init— int
DriverItem/DriverInit
Driver Name— string
DriverItem/DriverName
Driver Object Address— int
DriverItem/DriverObjectAddress
Driver StartIo— int
DriverItem/DriverStartIo
Driver Unload— int
DriverItem/DriverUnload
DriverItem IRP_MJ_CLEANUP— int
DriverItem/IRP_MJ_CLEANUP
DriverItem IRP_MJ_CLOSE— int
DriverItem/IRP_MJ_CLOSE
DriverItem IRP_MJ_CREATE— int
DriverItem/IRP_MJ_CREATE
DriverItem IRP_MJ_CREATE_MAILSLOT— int
DriverItem/IRP_MJ_CREATE_MAILSLOT
DriverItem IRP_MJ_CREATE_NAMED_PIPE— int
DriverItem/IRP_MJ_CREATE_NAMED_PIPE
DriverItem IRP_MJ_DEVICE_CHANGE— int
DriverItem/IRP_MJ_DEVICE_CHANGE
DriverItem IRP_MJ_DEVICE_CONTROL— int
DriverItem/IRP_MJ_DEVICE_CONTROL
DriverItem IRP_MJ_DIRECTORY_CONTROL— int
DriverItem/IRP_MJ_DIRECTORY_CONTROL
DriverItem IRP_MJ_FILE_SYSTEM_CONTROL— int
DriverItem/IRP_MJ_FILE_SYSTEM_CONTROL
DriverItem IRP_MJ_FLUSH_BUFFERS— int
DriverItem/IRP_MJ_FLUSH_BUFFERS
DriverItem IRP_MJ_INTERNAL_DEVICE_CONTROL— int
DriverItem/IRP_MJ_INTERNAL_DEVICE_CONTROL
DriverItem IRP_MJ_LOCK_CONTROL— int
DriverItem/IRP_MJ_LOCK_CONTROL
DriverItem IRP_MJ_PNP— int
DriverItem/IRP_MJ_PNP
DriverItem IRP_MJ_POWER— int
DriverItem/IRP_MJ_POWER
DriverItem IRP_MJ_QUERY_EA— int
DriverItem/IRP_MJ_QUERY_EA
DriverItem IRP_MJ_QUERY_INFORMATION— int
DriverItem/IRP_MJ_QUERY_INFORMATION
DriverItem IRP_MJ_QUERY_QUOTA— int
DriverItem/IRP_MJ_QUERY_QUOTA
DriverItem IRP_MJ_QUERY_SECURITY— int
DriverItem/IRP_MJ_QUERY_SECURITY
DriverItem IRP_MJ_QUERY_VOLUME_INFORMATION— int
DriverItem/IRP_MJ_QUERY_VOLUME_INFORMATION
DriverItem IRP_MJ_READ— int
DriverItem/IRP_MJ_READ
DriverItem IRP_MJ_SET_EA— int
DriverItem/IRP_MJ_SET_EA
DriverItem IRP_MJ_SET_INFORMATION— int
DriverItem/IRP_MJ_SET_INFORMATION
DriverItem IRP_MJ_SET_QUOTA— int
DriverItem/IRP_MJ_SET_QUOTA
DriverItem IRP_MJ_SET_SECURITY— int
DriverItem/IRP_MJ_SET_SECURITY
DriverItem IRP_MJ_SET_VOLUME_INFORMATION— int
DriverItem/IRP_MJ_SET_VOLUME_INFORMATION
DriverItem IRP_MJ_SHUTDOWN— int
DriverItem/IRP_MJ_SHUTDOWN
DriverItem IRP_MJ_SYSTEM_CONTROL— int
DriverItem/IRP_MJ_SYSTEM_CONTROL
DriverItem IRP_MJ_WRITE— int
DriverItem/IRP_MJ_WRITE
Driver Image Base— int
DriverItem/ImageBase
Driver Image Size— int
DriverItem/ImageSize
Driver Md5sum— md5
DriverItem/Md5sum
int Driver PEInfo Base Address— int
DriverItem/PEInfo/BaseAddress
Driver PEInfo Detected Anomalies— string
DriverItem/PEInfo/DetectedAnomalies/string
Driver PEInfo Detected Entry Point Signature Name— string
DriverItem/PEInfo/DetectedEntryPointSignature/Name
Driver PEInfo Detected Entry Point Signature Type— string
DriverItem/PEInfo/DetectedEntryPointSignature/Type
Driver Certificate Issuer— string
DriverItem/PEInfo/DigitalSignature/CertificateIssuer
Driver Certificate Subject— string
DriverItem/PEInfo/DigitalSignature/CertificateSubject
Driver Signature Description— string
DriverItem/PEInfo/DigitalSignature/Description
Driver Signature Exists— bool
DriverItem/PEInfo/DigitalSignature/SignatureExists
Driver Signature Verified— bool
DriverItem/PEInfo/DigitalSignature/SignatureVerified
Driver PEInfo EpJumpCodes Depth— int
DriverItem/PEInfo/EpJumpCodes/Depth
Driver PEInfo EpJumpCodes Opcodes— string
DriverItem/PEInfo/EpJumpCodes/Opcodes
Driver Exported Function— string
DriverItem/PEInfo/Exports/ExportedFunctions/string
Driver Exports Time Stamp— date
DriverItem/PEInfo/Exports/ExportsTimeStamp
Driver Exports Dll Name— string
DriverItem/PEInfo/Exports/DllName
Driver Number Of Functions— int
DriverItem/PEInfo/Exports/NumberOfFunctions
Driver Number Of Names— int
DriverItem/PEInfo/Exports/NumberOfNames
Driver PEInfo Extraneous Bytes— string
DriverItem/PEInfo/ExtraneousBytes
Driver Imported Function— string
DriverItem/PEInfo/ImportedModules/Module/ImportedFunctions/string
Driver Imported Module Name— string
DriverItem/PEInfo/ImportedModules/Module/Name
Driver PEInfo PEChecksum PEComputedAPI— int
DriverItem/PEInfo/PEChecksum/PEComputedAPI
Driver PEInfo PEChecksum PEFileAPI — int
DriverItem/PEInfo/PEChecksum/PEFileAPI
Driver PEInfo PEChecksum PEFileRaw— int
DriverItem/PEInfo/PEChecksum/PEFileRaw
Driver PEInfo PETimeStamp— date
DriverItem/PEInfo/PETimeStamp
Driver PEInfo Sections Section Detected Characteristics— string
DriverItem/PEInfo/Sections/Section/DetectedCharacteristics
Driver PEInfo Sections Section Detected Signature Keys— string
DriverItem/PEInfo/Sections/Section/DetectedSignatureKeys/string
Driver PEInfo Sections Section Entropy CurveData float— float
DriverItem/PEInfo/Sections/Section/Entropy/CurveData/float
Driver PEInfo Sections Section Name— string
DriverItem/PEInfo/Sections/Section/Name
Driver PEInfo Sections Section Size— int
DriverItem/PEInfo/Sections/Section/SizeInBytes
Driver PEInfo Sections Section Type — string
DriverItem/PEInfo/Sections/Section/Type
Driver PEInfo Subsystem— string
DriverItem/PEInfo/Subsystem
Driver PEInfo Type— string
DriverItem/PEInfo/Type
Driver Sha1sum— sha1
DriverItem/Sha1sum
Driver Sha256sum— sha256
DriverItem/Sha256sum
Driver Signature Description— string
DriverItem/SignatureDescription
Driver Signature Exists— bool
DriverItem/SignatureExists
Driver Signature Verified— bool
DriverItem/SignatureVerified
Driver String— string
DriverItem/StringList/string
Email attachment content— string
Email/Attachment/Content
Email Attachment MIME Type— string
Email/Attachment/MIMEType
Email Attachment Name— string
Email/Attachment/Name
Email Attachment Size— int
Email/Attachment/SizeInBytes
Email Attachment Count— int
Email/AttachmentCount
Email BCC Recipient(s)— string
Email/BCC
Email Body Text— string
Email/Body
Email CC Recipients(s)— string
Email/CC
Email Content-Type— string
Email/Content-Type
Email Date (Sent)— date
Email/Date
Email Sender— string
Email/From
Email In-Reply-To— string
Email/In-Reply-To
Email MIME-Version— string
Email/MIME-Version
Email Received Date— string
Email/Received
Email Received From Host— string
Email/ReceivedFromHost
Email Received From IP— IP
Email/ReceivedFromIP
Email References— string
Email/References
Email Return Path— string
Email/Return-Path
Email Subject— string
Email/Subject
Email Thread-Index— string
Email/Thread-Index
Email Thread-Topic— string
Email/Thread-Topic
Email Recipients— string
Email/To
Email X-MS-Has-Attach— string
Email/X-MS-Has-Attach
Email X-filenames— string
Email/X-filenames
Email X-filesizes— int
Email/X-filesizes
Email X-filetypes— string
Email/X-filetypes
EventLog Correlation Activity Id— string
EventLogItem/CorrelationActivityId
EventLog Correlation Related Activity Id— string
EventLogItem/CorrelationRelatedActivityId
EventLog ID— int
EventLogItem/EID
EventLog Execution Process Id— int
EventLogItem/ExecutionProcessId
EventLog Execution Thread Id— int
EventLogItem/ExecutionThreadId
EventLog blob— string
EventLogItem/blob
EventLog category— string
EventLogItem/category
EventLog categoryNum— string
EventLogItem/categoryNum
EventLog GenTime— date
EventLogItem/genTime
EventLog index— int
EventLogItem/index
EventLog log— string
EventLogItem/log
EventLog machine— string
EventLogItem/machine
EventLog Message— string
EventLogItem/message
EventLog reserved— string
EventLogItem/reserved
EventLog source— string
EventLogItem/source
EventLog type— string
EventLogItem/type
EventLog unformatted Message— string
EventLogItem/unformattedMessage/string
EventLog user— string
EventLogItem/user
EventLog writeTime— date
EventLogItem/writeTime
FileDownloadHistory AutoResume— string
FileDownloadHistoryItem/AutoResume
FileDownloadHistory Browser Name— string
FileDownloadHistoryItem/BrowserName
FileDownloadHistory Browser Version— string
FileDownloadHistoryItem/BrowserVersion
FileDownloadHistory Bytes Downloaded— int
FileDownloadHistoryItem/BytesDownloaded
FileDownloadHistory Cache Flags— string
FileDownloadHistoryItem/CacheFlags
FileDownloadHistory Cache Hit Coun— int
FileDownloadHistoryItem/CacheHitCount
FileDownloadHistory Download Type— string
FileDownloadHistoryItem/DownloadType
FileDownloadHistory End Date— date
FileDownloadHistoryItem/EndDate
FileDownloadHistory File Name— string
FileDownloadHistoryItem/FileName
FileDownloadHistory Full Http Header— string
FileDownloadHistoryItem/FullHttpHeader
FileDownloadHistory Last Accessed Date— date
FileDownloadHistoryItem/LastAccessedDate
FileDownloadHistory Last Cache Synch Date— date
FileDownloadHistoryItem/LastCacheSynchDate
FileDownloadHistory Last Checked Date— date
FileDownloadHistoryItem/LastCheckedDate
FileDownloadHistory Last Modified Date— date
FileDownloadHistoryItem/LastModifiedDate
FileDownloadHistory Max Bytes— int
FileDownloadHistoryItem/MaxBytes
FileDownloadHistory MimeType— string
FileDownloadHistoryItem/MimeType
FileDownloadHistory Profile— string
FileDownloadHistoryItem/Profile
FileDownloadHistory Referrer— string
FileDownloadHistoryItem/Referrer
FileDownloadHistory Source URL— string
FileDownloadHistoryItem/SourceURL
FileDownloadHistory Start Date— date
FileDownloadHistoryItem/StartDate
FileDownloadHistory State— string
FileDownloadHistoryItem/State
FileDownloadHistory Target Directory— string
FileDownloadHistoryItem/TargetDirectory
FileDownloadHistory Temporary Path— string
FileDownloadHistoryItem/TemporaryPath
FileDownloadHistory Username— string
FileDownloadHistoryItem/Username
File Accessed Time— date
FileItem/Accessed
File Changed Time— date
FileItem/Changed
File Created Time— date
FileItem/Created
File DevicePath— string
FileItem/DevicePath
File Drive— string
FileItem/Drive
File Attribute— string
FileItem/FileAttributes
File Extension— string
FileItem/FileExtension
File Name— string
FileItem/FileName
File Path— string
FileItem/FilePath
File Filename Accessed— date
FileItem/FilenameAccessed
File Filename Changed— date
FileItem/FilenameChanged
File Filename Created— date
FileItem/FilenameCreated
File Filename Modified— date
FileItem/FilenameModified
File Full Path— string
FileItem/FullPath
File INode— int
FileItem/INode
File MD5— md5
FileItem/Md5sum
File Modified Time— date
FileItem/Modified
detectedAnomaly— string
FileItem/detectedAnomaly
File Base Address— int
FileItem/PEInfo/BaseAddress
File PE Detected Anomalies— string
FileItem/PEInfo/DetectedAnomalies/string
File EntryPoint Sig Name— string
FileItem/PEInfo/DetectedEntryPointSignature/Name
File EntryPoint Sig Type— string
FileItem/PEInfo/DetectedEntryPointSignature/Type
File Certificate Issuer— string
FileItem/PEInfo/DigitalSignature/CertificateIssuer
File Certificate Subject— string
FileItem/PEInfo/DigitalSignature/CertificateSubject
File Digital Signature Description— string
FileItem/PEInfo/DigitalSignature/Description
File Digital Signature Exists— bool
FileItem/PEInfo/DigitalSignature/SignatureExists
File Digital Signature Verified— bool
FileItem/PEInfo/DigitalSignature/SignatureVerified
File Double Jump— int
FileItem/PEInfo/EpJumpCodes/Depth
File PEInfo EpJumpCodes Opcodes— string
FileItem/PEInfo/EpJumpCodes/Opcodes
File Dll Export Name— string
FileItem/PEInfo/Exports/DllName
File Export Function— string
FileItem/PEInfo/Exports/ExportedFunctions/string
File Exports Time Stamp— date
FileItem/PEInfo/Exports/ExportsTimeStamp
File Export Count— int
FileItem/PEInfo/Exports/NumberOfFunctions
File Export Number Of Names— int
FileItem/PEInfo/Exports/NumberOfNames
File Extraneous Bytes— string
FileItem/PEInfo/ExtraneousBytes
File Import Function— string
FileItem/PEInfo/ImportedModules/Module/ImportedFunctions/string
File Import Name— string
FileItem/PEInfo/ImportedModules/Module/Name
File Number of Imported Functions— int
FileItem/PEInfo/ImportedModules/Module/NumberOfFunctions
File PE ComputedAPI— int
FileItem/PEInfo/PEChecksum/PEComputedAPI
File PE Checksum API— int
FileItem/PEInfo/PEChecksum/PEFileAPI
File PEFileRaw— int
FileItem/PEInfo/PEChecksum/PEFileRaw
File Compile Time— date
FileItem/PEInfo/PETimeStamp
File PEInfo Resource Info Data— string
FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Data
File PEInfo Resource Info Language— string
FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Language
File PEInfo Resource Info Name— string
FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Name
File PEInfo Resource Info Size— int
FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Size
File PEInfo Resource Info Type— string
FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Type
File PEInfo Number of Sections— int
FileItem/PEInfo/Sections/NumberOfSections
File PEInfo Actual Number of Sections— int
FileItem/PEInfo/Sections/ActualNumberOfSections
File Detected Characteristics— string
FileItem/PEInfo/Sections/Section/DetectedCharacteristics
File Detected Signatures— string
FileItem/PEInfo/Sections/Section/DetectedSignatureKeys/string
File PEInfo Sections Section Entropy CurveData— float
FileItem/PEInfo/Sections/Section/Entropy/CurveData/float
File Section Name— string
FileItem/PEInfo/Sections/Section/Name
File PE Section Size— int
FileItem/PEInfo/Sections/Section/SizeInBytes
File PE Section Type— string
FileItem/PEInfo/Sections/Section/Type
File PE Subsystem— string
FileItem/PEInfo/Subsystem
File PE Type— string
FileItem/PEInfo/Type
File PEInfo Version Info Comments— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/Comments
File PEInfo Version Info CompanyName— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/CompanyName
File PEInfo Version Info FileDescription— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileDescription
File PEInfo Version Info FileVersion— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileVersion
File PEInfo Version Info InternalName— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/InternalName
File PEInfo Version Info Language— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/Language
File PEInfo Version Info LegalCopyright— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalCopyright
File PEInfo Version Info LegalTrademarks— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalTrademarks
File PEInfo Version Info OriginalFilename— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/OriginalFilename
File PEInfo Version Info PrivateBuild— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/PrivateBuild
File PEInfo Version Info ProductName— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductName
File PEInfo Version Info ProductVersion— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductVersion
File PEInfo Version Info SpecialBuild— string
FileItem/PEInfo/VersionInfoList/VersionInfoItem/SpecialBuild
File Peak Code Entropy— float
FileItem/PeakCodeEntropy
File Peak Entropy— float
FileItem/PeakEntropy
File Security ID— string
FileItem/SecurityID
File Security Type— string
FileItem/SecurityType
File Sha1sum— sha1
FileItem/Sha1sum
File Sha256sum— sha256
FileItem/Sha256sum
File Size— int
FileItem/SizeInBytes
File ADS MD5— md5
FileItem/StreamList/Stream/Md5sum
File ADS Name— string
FileItem/StreamList/Stream/Name
File Stream Sha1sum— sha1
FileItem/StreamList/Stream/Sha1sum
File Stream Sha256sum— sha256
FileItem/StreamList/Stream/Sha256sum
File ADS Size— int
FileItem/StreamList/Stream/SizeInBytes
File Strings— string
FileItem/StringList/string
File Owner— string
FileItem/Username
FormHistory Browser Name— string
FormHistoryItem/BrowserName
FormHistory Browser Version— string
FormHistoryItem/BrowserVersion
FormHistory Creation Date— date
FormHistoryItem/CreationDate
FormHistory Encrypted Password— string
FormHistoryItem/EncryptedPassword
FormHistory Encryption Type— string
FormHistoryItem/EncryptionType
FormHistory First Used Date— date
FormHistoryItem/FirstUsedDate
FormHistory Form Field Name— string
FormHistoryItem/FormFieldName
FormHistory Form Field Value— string
FormHistoryItem/FormFieldValue
FormHistory Form Submit URL— string
FormHistoryItem/FormSubmitURL
FormHistory Form Type— string
FormHistoryItem/FormType
FormHistory Guid— string
FormHistoryItem/Guid
FormHistory Host Name— string
FormHistoryItem/HostName
FormHistory Http Realm— string
FormHistoryItem/HttpRealm
FormHistory Last Used Date— date
FormHistoryItem/LastUsedDate
FormHistory Password Field Name— string
FormHistoryItem/PasswordFieldName
FormHistory Profile— string
FormHistoryItem/Profile
FormHistory Times Used— int
FormHistoryItem/TimesUsed
FormHistory Username— string
FormHistoryItem/Username
FormHistory Username Field Name— string
FormHistoryItem/UsernameFieldName
FormHistory Username Field Value— string
FormHistoryItem/UsernameFieldValue
Hive Name— string
HiveItem/Name
Hive Path— string
HiveItem/Path
Hook Digital Signature Hooked Certificate Issuer— string
HookItem/DigitalSignatureHooked/CertificateIssuer
Hook Digital Signature Hooked Certificate Subject— string
HookItem/DigitalSignatureHooked/CertificateSubject
Hook Digital Signature Hooked Description— string
HookItem/DigitalSignatureHooked/Description
Hook Digital Signature Hooked Signature Exists— bool
HookItem/DigitalSignatureHooked/SignatureExists
Hook Digital Signature Hooked Signature Verified— bool
HookItem/DigitalSignatureHooked/SignatureVerified
Hook Digital Signature Hooking Certificate Issuer— string
HookItem/DigitalSignatureHooking/CertificateIssuer
Hook Digital Signature Hooking Certificate Subject— string
HookItem/DigitalSignatureHooking/CertificateSubject
Hook Digital Signature Hooking Description— string
HookItem/DigitalSignatureHooking/Description
Hook Digital Signature Hooking Signature Exists— bool
HookItem/DigitalSignatureHooking/SignatureExists
Hook Digital Signature Hooking Signature Verified— bool
HookItem/DigitalSignatureHooking/SignatureVerified
Hook Description— string
HookItem/HookDescription
Hook Hooked Function— string
HookItem/HookedFunction
Hook Hooked Module— string
HookItem/HookedModule
Hook Hooking Address— int
HookItem/HookingAddress
Hook Hooking Module— string
HookItem/HookingModule
Log Line Argument— string
Log/args/arg
Log Line Flags— int
Log/flags
Log Line Function— string
Log/fn
Log Line High-Resolution Time— int
Log/hr
Log Line LID— int
Log/lid
Log Line Function Line Number— int
Log/ln
Log Line Level— string
Log/lvl
Log Line Message— string
Log/msg
Log Line PID— int
Log/pid
Log Line TID— int
Log/tid
Log Line Date— date
Log/time
Log Line UID— int
Log/uid
Module Address— int
ModuleItem/ModuleAddress
Module Base— int
ModuleItem/ModuleBase
Module Init— int
ModuleItem/ModuleInit
Module Name— string
ModuleItem/ModuleName
Module Path— string
ModuleItem/ModulePath
Module Size— int
ModuleItem/ModuleSize
Network DNS— string
Network/DNS
Network String HTTP Referr— string
Network/HTTP_Referr
Network String General— string
Network/String
Network String URI— string
Network/URI
Network String User Agent— string
Network/UserAgent
Persistence FileItem Accessed— date
PersistenceItem/FileItem/Accessed
Persistence FileItem Changed— date
PersistenceItem/FileItem/Changed
Persistence FileItem Created— date
PersistenceItem/FileItem/Created
Persistence FileItem Device Path— string
PersistenceItem/FileItem/DevicePath
Persistence FileItem Drive— string
PersistenceItem/FileItem/Drive
Persistence FileItem File Attributes— string
PersistenceItem/FileItem/FileAttributes
Persistence FileItem File Extension— string
PersistenceItem/FileItem/FileExtension
Persistence FileItem File Name— string
PersistenceItem/FileItem/FileName
Persistence FileItem File Path— string
PersistenceItem/FileItem/FilePath
Persistence FileItem Filename Accessed— date
PersistenceItem/FileItem/FilenameAccessed
Persistence FileItem Filename Changed— date
PersistenceItem/FileItem/FilenameChanged
Persistence FileItem Filename Created— date
PersistenceItem/FileItem/FilenameCreated
Persistence FileItem Filename Modified— date
PersistenceItem/FileItem/FilenameModified
Persistence FileItem Full Path— string
PersistenceItem/FileItem/FullPath
Persistence FileItem INode— int
PersistenceItem/FileItem/INode
Persistence FileItem Md5sum— md5
PersistenceItem/FileItem/Md5sum
Persistence FileItem Modified— date
PersistenceItem/FileItem/Modified
Persistence FileItem Size In Bytes— int
PersistenceItem/FileItem/SizeInBytes
Persistence FileItem PEInfo Base Address— int
PersistenceItem/FileItem/PEInfo/BaseAddress
Persistence FileItem PEInfo Detected Anomalies string— string
PersistenceItem/FileItem/PEInfo/DetectedAnomalies/string
Persistence FileItem PEInfo Detected Entry Point Signature Name— string
PersistenceItem/FileItem/PEInfo/DetectedEntryPointSignature/Name
Persistence FileItem PEInfo Detected Entry Point Signature Type— string
PersistenceItem/FileItem/PEInfo/DetectedEntryPointSignature/Type
Persistence FileItem PEInfo DigitalSignature Certificate Issuer — string
PersistenceItem/FileItem/PEInfo/DigitalSignature/CertificateIssuer
Persistence FileItem PEInfo DigitalSignature Certificate Subject— string
PersistenceItem/FileItem/PEInfo/DigitalSignature/CertificateSubject
Persistence FileItem PEInfo DigitalSignature Description— string
PersistenceItem/FileItem/PEInfo/DigitalSignature/Description
Persistence FileItem PEInfo DigitalSignature Signature Exists— bool
PersistenceItem/FileItem/PEInfo/DigitalSignature/SignatureExists
Persistence FileItem PEInfo DigitalSignature Signature Verified — bool
PersistenceItem/FileItem/PEInfo/DigitalSignature/SignatureVerified
Persistence FileItem PEInfo EpJumpCodes Depth— int
PersistenceItem/FileItem/PEInfo/EpJumpCodes/Depth
Persistence FileItem PEInfo EpJumpCodes Opcodes— string
PersistenceItem/FileItem/PEInfo/EpJumpCodes/OpCodes
Persistence FileItem PEInfo Exports Exported Functions string— string
PersistenceItem/FileItem/PEInfo/Exports/ExportedFunctions/string
Persistence FileItem PEInfo Exports Exports Time Stamp— date
PersistenceItem/FileItem/PEInfo/Exports/ExportsTimeStamp
Persistence FileItem PEInfo Exports Number Of Functions— int
PersistenceItem/FileItem/PEInfo/Exports/NumberOfFunctions
Persistence FileItem PEInfo Exports Number Of Names— int
PersistenceItem/FileItem/PEInfo/Exports/NumberOfNames
Persistence FileItem PEInfo Extraneous Bytes— int
PersistenceItem/FileItem/PEInfo/ExtraneousBytes
Persistence FileItem PEInfo Imported Modules Module Imported Functions string— string
PersistenceItem/FileItem/PEInfo/ImportedModules/Module/ImportedFunctions/string
Persistence FileItem PEInfo Imported Modules Module Name— string
PersistenceItem/FileItem/PEInfo/ImportedModules/Module/Name
Persistence FileItem PEInfo PEChecksum PE Computed API— int
PersistenceItem/FileItem/PEInfo/PEChecksum/PEComputedAPI
Persistence FileItem PEInfo PEChecksum PE File API— int
PersistenceItem/FileItem/PEInfo/PEChecksum/PEFileAPI
Persistence FileItem PEInfo PEChecksum PE File Raw— int
PersistenceItem/FileItem/PEInfo/PEChecksum/PEFileRaw
Persistence FileItem PEInfo PE Time Stamp— date
PersistenceItem/FileItem/PEInfo/PETimeStamp
Persistence FileItem PEInfo ResourceInfoList ResourceInfoItem Language— string
PersistenceItem/FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Language
Persistence FileItem PEInfo ResourceInfoList ResourceInfoItem Name— string
PersistenceItem/FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Name
Persistence FileItem PEInfo ResourceInfoList ResourceInfoItem Size— int
PersistenceItem/FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Size
Persistence FileItem PEInfo ResourceInfoList ResourceInfoItem Type— string
PersistenceItem/FileItem/PEInfo/ResourceInfoList/ResourceInfoItem/Type
Persistence FileItem PEInfo Sections Section Detected Characteristics— string
PersistenceItem/FileItem/PEInfo/Sections/Section/DetectedCharacteristics
Persistence FileItem PEInfo Sections Section Detected Signature Keys string— string
PersistenceItem/FileItem/PEInfo/Sections/Section/DetectedSignatureKeys/string
Persistence FileItem PEInfo Sections Section Entropy Curve Data float— float
PersistenceItem/FileItem/PEInfo/Sections/Section/Entropy/CurveData/float
Persistence FileItem PEInfo Sections Section Name— string
PersistenceItem/FileItem/PEInfo/Sections/Section/Name
Persistence FileItem PEInfo Sections Section SizeInBytes— int
PersistenceItem/FileItem/PEInfo/Sections/Section/SizeInBytes
Persistence FileItem PEInfo Sections Section Type— string
PersistenceItem/FileItem/PEInfo/Sections/Section/Type
Persistence FileItem PEInfo Subsystem— string
PersistenceItem/FileItem/PEInfo/Subsystem
Persistence FileItem PEInfo Type— string
PersistenceItem/FileItem/PEInfo/Type
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Comments— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/Comments
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Company Name— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/CompanyName
Persistence FileItem PEInfo VersionInfoList VersionInfoItem File Description— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileDescription
Persistence FileItem PEInfo VersionInfoList VersionInfoItem File Version— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/FileVersion
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Internal Name— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/InternalName
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Language— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/Language
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Legal Copyright— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalCopyright
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Legal Trademarks— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/LegalTrademarks
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Original Filename— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/OriginalFilename
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Private Build— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/PrivateBuild
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Product Name— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductName
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Product Version — string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/ProductVersion
Persistence FileItem PEInfo VersionInfoList VersionInfoItem Special Build— string
PersistenceItem/FileItem/PEInfo/VersionInfoList/VersionInfoItem/SpecialBuild
Persistence FileItem Peak Code Entropy— int
PersistenceItem/FileItem/PeakCodeEntropy
Persistence FileItem Peak Entropy— int
PersistenceItem/FileItem/PeakEntropy
Persistence FileItem Security ID— string
PersistenceItem/FileItem/SecurityID
Persistence FileItem Security Type— string
PersistenceItem/FileItem/SecurityType
Persistence FileItem Sha1sum— sha1
PersistenceItem/FileItem/Sha1sum
Persistence FileItem Sha256sum— sha256
PersistenceItem/FileItem/Sha256sum
Persistence FileItem Stream List Stream Md5sum— int
PersistenceItem/FileItem/StreamList/Stream/Md5sum
Persistence FileItem Stream List Stream Name— string
PersistenceItem/FileItem/StreamList/Stream/Name
Persistence FileItem Stream List Stream Sha1sum— sha1
PersistenceItem/FileItem/StreamList/Stream/Sha1sum
Persistence FileItem Stream List Stream Sha256sum— sha256
PersistenceItem/FileItem/StreamList/Stream/Sha256sum
Persistence FileItem Stream List Stream Size In Bytes— int
PersistenceItem/FileItem/StreamList/Stream/SizeInBytes
Persistence FileItem Username— string
PersistenceItem/FileItem/Username
Persistence Link File Path — string
PersistenceItem/LinkFilePath
Persistence Type— string
PersistenceItem/PersistenceType
Persistence Reg Context— string
PersistenceItem/RegContext
Persistence RegistryItem Hive— string
PersistenceItem/RegistryItem/Hive
Persistence RegistryItem Key Path— string
PersistenceItem/RegistryItem/KeyPath
Persistence RegistryItem NumSubKeys— int
PersistenceItem/RegistryItem/NumSubKeys
Persistence RegistryItem NumValues— string
PersistenceItem/RegistryItem/NumValues
Persistence RegistryItem Modified— date
PersistenceItem/RegistryItem/Modified
Persistence RegistryItem Path— string
PersistenceItem/RegistryItem/Path
Persistence RegistryItem Reported Length In Bytes— int
PersistenceItem/RegistryItem/ReportedLengthInBytes
Persistence RegistryItem Security ID— string
PersistenceItem/RegistryItem/SecurityID
Persistence RegistryItem Text— string
PersistenceItem/RegistryItem/Text
Persistence RegistryItem Type— string
PersistenceItem/RegistryItem/Type
Persistence RegistryItem Username— string
PersistenceItem/RegistryItem/Username
Persistence RegistryItem Value— string
PersistenceItem/RegistryItem/Value
Persistence RegistryItem Value Name— string
PersistenceItem/RegistryItem/ValueName
Persistence ServiceItem Arguments— string
PersistenceItem/ServiceItem/arguments
Persistence ServiceItem Description— string
PersistenceItem/ServiceItem/description
Persistence ServiceItem Descriptive Name— string
PersistenceItem/ServiceItem/descriptiveName
Persistence ServiceItem Mode— string
PersistenceItem/ServiceItem/mode
Persistence ServiceItem Name— string
PersistenceItem/ServiceItem/name
Persistence ServiceItem Path— string
PersistenceItem/ServiceItem/path
Persistence ServiceItem Path Certificate Issuer— string
PersistenceItem/ServiceItem/pathCertificateIssuer
Persistence ServiceItem Path Certificate Subject— string
PersistenceItem/ServiceItem/pathCertificateSubject
Persistence ServiceItem Path Signature Description— string
PersistenceItem/ServiceItem/pathSignatureDescription
Persistence ServiceItem Path Signature Exists— bool
PersistenceItem/ServiceItem/pathSignatureExists
Persistence ServiceItem Path Signature Verified— bool
PersistenceItem/ServiceItem/pathSignatureVerified
Persistence ServiceItem Path Md5sum— md5
PersistenceItem/ServiceItem/pathmd5sum
Persistence ServiceItem Path Sha1sum— sha1
PersistenceItem/ServiceItem/pathsha1sum
Persistence ServiceItem Path Sha256sum— sha256
PersistenceItem/ServiceItem/pathsha256sum
Persistence ServiceItem PID— int
PersistenceItem/ServiceItem/pid
Persistence ServiceItem Service DLL— string
PersistenceItem/ServiceItem/serviceDLL
Persistence ServiceItem Service DLL Certificate Issuer— string
PersistenceItem/ServiceItem/serviceDLLCertificateIssuer
Persistence ServiceItem Service DLL Certificate Subject— string
PersistenceItem/ServiceItem/serviceDLLCertificateSubject
Persistence ServiceItem Service DLL Signature Description— string
PersistenceItem/ServiceItem/serviceDLLSignatureDescription
Persistence ServiceItem Service DLL Signature Exists— bool
PersistenceItem/ServiceItem/serviceDLLSignatureExists
Persistence ServiceItem Service DLL Signature Verified— bool
PersistenceItem/ServiceItem/serviceDLLSignatureVerified
Persistence ServiceItem Service DLL Md5sum— md5
PersistenceItem/ServiceItem/serviceDLLmd5sum
Persistence ServiceItem Service DLL Sha1sum— sha1
PersistenceItem/ServiceItem/serviceDLLsha1sum
Persistence ServiceItem Service DLL Sha256sum— sha256
PersistenceItem/ServiceItem/serviceDLLsha256sum
Persistence ServiceItem Started As— string
PersistenceItem/ServiceItem/startedAs
Persistence ServiceItem Status— string
PersistenceItem/ServiceItem/status
Persistence ServiceItem Type— string
PersistenceItem/ServiceItem/type
Port Creation Time— date
PortItem/CreationTime
Port Local IP— IP
PortItem/localIP
Port Local Port— int
PortItem/localPort
Port Path— string
PortItem/path
Port PID— int
PortItem/pid
Port Process— string
PortItem/process
Port Protocol— string
PortItem/protocol
Port Remote IP— IP
PortItem/remoteIP
Port Remote Port— int
PortItem/remotePort
Port State— string
PortItem/state
Prefetch Accessed File— string
PrefetchItem/AccessedFileList/AccessedFile
Prefetch File Executed— string
PrefetchItem/ApplicationFileName
Prefetch Application Full Path— string
PrefetchItem/ApplicationFullPath
Prefetch File Created— date
PrefetchItem/Created
Prefetch Full Path— string
PrefetchItem/FullPath
Prefetch Last Run— date
PrefetchItem/LastRun
Prefetch Hash— string
PrefetchItem/PrefetchHash
Prefetch Volume Device Path— string
PrefetchItem/VolumeList/VolumeItem/DevicePath
Prefetch Volume Creation Time— date
PrefetchItem/VolumeList/VolumeItem/CreationTime
Prefetch Volume Serial Number— string
PrefetchItem/VolumeList/VolumeItem/SerialNumber
Prefetch Reported Size— int
PrefetchItem/ReportedSizeInBytes
Prefetch Size— int
PrefetchItem/SizeInBytes
Prefetch Times Executed— int
PrefetchItem/TimesExecuted
Process Handle Access Mask— string
ProcessItem/HandleList/Handle/AccessMask
Process Handle Count— int
ProcessItem/HandleList/Handle/HandleCount
Process Handle Index— int
ProcessItem/HandleList/Handle/Index
Process Handle Name— string
ProcessItem/HandleList/Handle/Name
Process Handle Object Address— string
ProcessItem/HandleList/Handle/ObjectAddress
Process Handle Pointer Count— string
ProcessItem/HandleList/Handle/PointerCount
Process Handle Type— string
ProcessItem/HandleList/Handle/Type
Process Port Creation Time— date
ProcessItem/PortList/PortItem/CreationTime
Process Port Local IP— IP
ProcessItem/PortList/PortItem/localIP
Process Local Port— int
ProcessItem/PortList/PortItem/localPort
Process Port Path— string
ProcessItem/PortList/PortItem/path
Process Port PID— int
ProcessItem/PortList/PortItem/pid
Process Port Process— string
ProcessItem/PortList/PortItem/process
Process Port Protocol— string
ProcessItem/PortList/PortItem/protocol
Process Port Remote IP— IP
ProcessItem/PortList/PortItem/remoteIP
Process Remote Port— int
ProcessItem/PortList/PortItem/remotePort
Process State— string
ProcessItem/PortList/PortItem/state
Process Section Certificate Issuer— string
ProcessItem/SectionList/MemorySection/DigitalSignature/CertificateIssuer
Process Section Certificate Subject— string
ProcessItem/SectionList/MemorySection/DigitalSignature/CertificateSubject
Process Section Signature Description— string
ProcessItem/SectionList/MemorySection/DigitalSignature/Description
Process Section Signature Exists— bool
ProcessItem/SectionList/MemorySection/DigitalSignature/SignatureExists
Process Section Signature Verified— bool
ProcessItem/SectionList/MemorySection/DigitalSignature/SignatureVerified
Process Section Injected— bool
ProcessItem/SectionList/MemorySection/Injected
Process Mapped— string
ProcessItem/SectionList/MemorySection/Mapped
Process Section MD5— md5
ProcessItem/SectionList/MemorySection/Md5sum
Process Section MemD5— md5
ProcessItem/SectionList/MemorySection/MemD5
Process Section Name— string
ProcessItem/SectionList/MemorySection/Name
Process SectionList MemorySection PEInfo Base Address— int
ProcessItem/SectionList/MemorySection/PEInfo/BaseAddress
Process SectionList MemorySection PEInfo Detected Anomalies— string
ProcessItem/SectionList/MemorySection/PEInfo/DetectedAnomalies/string
Process SectionList MemorySection PEInfo Detected EntryPoint Signature Name— string
ProcessItem/SectionList/MemorySection/PEInfo/DetectedEntryPointSignature/Name
Process SectionList MemorySection PEInfo Detected EntryPoint Signature Type— string
ProcessItem/SectionList/MemorySection/PEInfo/DetectedEntryPointSignature/Type
Process SectionList MemorySection PEInfo Digital Signature Certificate Issuer— string
ProcessItem/SectionList/MemorySection/PEInfo/DigitalSignature/CertificateIssuer
Process SectionList MemorySection PEInfo Digital Signature Certificate Subject— string
ProcessItem/SectionList/MemorySection/PEInfo/DigitalSignature/CertificateSubject
Process SectionList MemorySection PEInfo Digital Signature Description— string
ProcessItem/SectionList/MemorySection/PEInfo/DigitalSignature/Description
Process SectionList MemorySection PEInfo Digital Signature Signature Exists— bool
ProcessItem/SectionList/MemorySection/PEInfo/DigitalSignature/SignatureExists
Process SectionList MemorySection PEInfo Digital Signature Signature Verified— bool
ProcessItem/SectionList/MemorySection/PEInfo/DigitalSignature/SignatureVerified
Process SectionList MemorySection PEInfo EpJumpCodes Depth— int
ProcessItem/SectionList/MemorySection/PEInfo/EpJumpCodes/Depth
Process SectionList MemorySection PEInfo EpJumpCodes Opcodes— string
ProcessItem/SectionList/MemorySection/PEInfo/EpJumpCodes/Opcodes
Process Section Exported Function— string
ProcessItem/SectionList/MemorySection/PEInfo/Exports/ExportedFunctions/string
Process Section Exports Time Stamp— date
ProcessItem/SectionList/MemorySection/PEInfo/Exports/ExportsTimeStamp
Process Section Number Of Functions— int
ProcessItem/SectionList/MemorySection/PEInfo/Exports/NumberOfFunctions
Process Section Export Number Of Names— int
ProcessItem/SectionList/MemorySection/PEInfo/Exports/NumberOfNames
Process SectionList MemorySection PEInfo Extraneous Bytes— string
ProcessItem/SectionList/MemorySection/PEInfo/ExtraneousBytes
Process Section Imported Function— string
ProcessItem/SectionList/MemorySection/PEInfo/ImportedModules/Module/ImportedFunctions/string
Process Section Imported Module— string
ProcessItem/SectionList/MemorySection/PEInfo/ImportedModules/Module/Name
Process SectionList MemorySection PEInfo PEChecksum PEComputedAPI— int
ProcessItem/SectionList/MemorySection/PEInfo/PEChecksum/PEComputedAPI
Process SectionList MemorySection PEInfo PEChecksum PEFileAPI— int
ProcessItem/SectionList/MemorySection/PEInfo/PEChecksum/PEFileAPI
Process SectionList MemorySection PEInfo PEChecksum PEFileRaw— int
ProcessItem/SectionList/MemorySection/PEInfo/PEChecksum/PEFileRaw
Process SectionList MemorySection PEInfo PETimeStamp— date
ProcessItem/SectionList/MemorySection/PEInfo/PETimeStamp
Process SectionList MemorySection PEInfo Sections Section Detected Characteristics— string
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/DetectedCharacteristics
Process SectionList MemorySection PEInfo Sections Section Detected Signature Keys— string
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/DetectedSignatureKeys/string
Process SectionList MemorySection PEInfo Sections Section Entropy Curve Data float— float
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/Entropy/CurveData/float
Process SectionList MemorySection PEInfo Sections Section Name— string
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/Name
Process SectionList MemorySection PEInfo Sections Section Size— int
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/SizeInBytes
Process SectionList MemorySection PEInfo Sections Section Type— string
ProcessItem/SectionList/MemorySection/PEInfo/Sections/Section/Type
Process SectionList MemorySection PEInfo Subsystem— string
ProcessItem/SectionList/MemorySection/PEInfo/Subsystem
Process SectionList MemorySection PEInfo Type— string
ProcessItem/SectionList/MemorySection/PEInfo/Type
Process Section Dll Export Name— string
ProcessItem/SectionList/MemorySection/PEInfo/Exports/DllName
Process Protection— string
ProcessItem/SectionList/MemorySection/Protection
Process Raw Flags— string
ProcessItem/SectionList/MemorySection/RawFlags
Process Region Size— int
ProcessItem/SectionList/MemorySection/RegionSize
Process Region Start— int
ProcessItem/SectionList/MemorySection/RegionStart
Process Section Sha1sum— sha1
ProcessItem/SectionList/MemorySection/Sha1sum
Process Section Sha256sum— sha256
ProcessItem/SectionList/MemorySection/Sha256sum
Process Security ID— string
ProcessItem/SecurityID
Process Security Type— string
ProcessItem/SecurityType
Process String— string
ProcessItem/StringList/string
Process Username— string
ProcessItem/Username
Process Arguments— string
ProcessItem/arguments
Detected Anomaly— string
ProcessItem/detectedAnomaly
Process Hidden— string
ProcessItem/hidden
Process Kernel Time— string
ProcessItem/kernelTime
Process Name— string
ProcessItem/name
Process Parent PID— int
ProcessItem/parentpid
Process Path— string
ProcessItem/path
Process PID— int
ProcessItem/pid
Process Start Time— date
ProcessItem/startTime
Process User Time— string
ProcessItem/userTime
Registry Hive— string
RegistryItem/Hive
Registry Key Path— string
RegistryItem/KeyPath
Registry Key Modified Date— date
RegistryItem/Modified
Registry NumSubKeys— int
RegistryItem/NumSubKeys
Registry NumValues— int
RegistryItem/NumValues
Registry Path— string
RegistryItem/Path
Registry Reported Length In Bytes— int
RegistryItem/ReportedLengthInBytes
Registry Security ID— string
RegistryItem/SecurityID
Registry Text— string
RegistryItem/Text
Registry Type— string
RegistryItem/Type
Registry Username— string
RegistryItem/Username
Registry Value— string
RegistryItem/Value
Registry Value Name— string
RegistryItem/ValueName
Detected Anomaly— string
RegistryItem/detectedAnomaly
Route Destination— IP
RouteEntryItem/Destination
Route Gateway— IP
RouteEntryItem/Gateway
Route Interface— string
RouteEntryItem/Interface
Route Is Autoconfigure Address— bool
RouteEntryItem/IsAutoconfigureAddress
Route Is IPv6— bool
RouteEntryItem/IsIPv6
Route Is Immortal— bool
RouteEntryItem/IsImmortal
Route Is Loopback— bool
RouteEntryItem/IsLoopback
Route Is Publish— bool
RouteEntryItem/IsPublish
Route Metric— int
RouteEntryItem/Metric
Route Netmask— IP
RouteEntryItem/Netmask
Route Origin— string
RouteEntryItem/Origin
Route Preferred Lifetime— date
RouteEntryItem/PreferredLifetime
Route Protocol— string
RouteEntryItem/Protocol
Route Age— string
RouteEntryItem/RouteAge
Route Type— string
RouteEntryItem/RouteType
Route Valid Lifetime— date
RouteEntryItem/ValidLifetime
Service arguments— string
ServiceItem/arguments
Service Description— string
ServiceItem/description
Service Descriptive Name— string
ServiceItem/descriptiveName
Service mode— string
ServiceItem/mode
Service Name— string
ServiceItem/name
Service Path— string
ServiceItem/path
Service Path Certificate Issuer— string
ServiceItem/pathCertificateIssuer
Service Path Certificate Subject— string
ServiceItem/pathCertificateSubject
Service Path Signature Description— string
ServiceItem/pathSignatureDescription
Service Path Signature Exists— bool
ServiceItem/pathSignatureExists
Service Path Signature Verified— bool
ServiceItem/pathSignatureVerified
Service Path MD5— md5
ServiceItem/pathmd5sum
Service Path Sha1sum— sha1
ServiceItem/pathsha1sum
Service Path Sha256sum— sha256
ServiceItem/pathsha256sum
Service PID— int
ServiceItem/pid
Service DLL— string
ServiceItem/serviceDLL
Service DLL Certificate Issuer— string
ServiceItem/serviceDLLCertificateIssuer
Service DLL Certificate Subject — string
ServiceItem/serviceDLLCertificateSubject
Service DLL Signature Description— string
ServiceItem/serviceDLLSignatureDescription
Service DLLSignature Exists— bool
ServiceItem/serviceDLLSignatureExists
Service DLL Signature Verified— bool
ServiceItem/serviceDLLSignatureVerified
Service DLL MD5— md5
ServiceItem/serviceDLLmd5sum
Service DLL Sha1sum— sha1
ServiceItem/serviceDLLsha1sum
Service DLL Sha256sum— sha256
ServiceItem/serviceDLLsha256sum
Service Started As— string
ServiceItem/startedAs
Service Status— string
ServiceItem/status
Service Type— string
ServiceItem/type
Snort Signature— string
Snort/Snort
SystemInfo MAC— string
SystemInfoItem/MAC
SystemInfo Operating System— string
SystemInfoItem/OS
SystemInfo Operating System Bitness— string
SystemInfoItem/OSBitness
SystemInfo App Created— date
SystemInfoItem/appCreated
SystemInfo App Version— string
SystemInfoItem/appVersion
SystemInfo Available Physical Memory— int
SystemInfoItem/availphysical
SystemInfo BIOS Date— string
SystemInfoItem/biosInfo/biosDate
SystemInfo BIOS Type— string
SystemInfoItem/biosInfo/biosType
SystemInfo BIOS Version— string
SystemInfoItem/biosInfo/biosVersion
SystemInfo Build Number— string
SystemInfoItem/buildNumber
SystemInfo Clock Skew— date
SystemInfoItem/clockSkew
SystemInfo Containment State— string
SystemInfoItem/containmentState
SystemInfo Containment Whitelist IP— IP
SystemInfoItem/containmentWhitelistArray/ip/ip
SystemInfo Date— date
SystemInfoItem/date
SystemInfo Directory— string
SystemInfoItem/directory
SystemInfo Domain— string
SystemInfoItem/domain
SystemInfo Drives— string
SystemInfoItem/drives
SystemInfo GMT Offset— date
SystemInfoItem/gmtoffset
SystemInfo Hostname— string
SystemInfoItem/hostname
SystemInfo Install Date— date
SystemInfoItem/installDate
SystemInfo IOMMU— string
SystemInfoItem/iommu
SystemInfo Logged On User— string
SystemInfoItem/loggedOnUser
SystemInfo LPC Device— string
SystemInfoItem/lpcDevice
SystemInfo Machine— string
SystemInfoItem/machine
string SystemInfo networkArray networkInfo MAC — string
SystemInfoItem/networkArray/networkInfo/MAC
SystemInfo Network Adapter— string
SystemInfoItem/networkArray/networkInfo/adapter
SystemInfo Network Description— string
SystemInfoItem/networkArray/networkInfo/description
SystemInfo Network DHCP Lease Expires— date
SystemInfoItem/networkArray/networkInfo/dhcpLeaseExpires
SystemInfo Network DHCP Lease Obtained— date
SystemInfoItem/networkArray/networkInfo/dhcpLeaseObtained
SystemInfo Network DHCP Server— IP
SystemInfoItem/networkArray/networkInfo/dhcpServerArray/dhcpServer
SystemInfo Network IP Address— IP
SystemInfoItem/networkArray/networkInfo/ipArray/ipInfo/ipAddress
SystemInfo Network IPv6 Address— IP
SystemInfoItem/networkArray/networkInfo/ipArray/ipInfo/ipv6Address
SystemInfo Network Subnet Mask— IP
SystemInfoItem/networkArray/networkInfo/ipArray/ipInfo/subnetMask
SystemInfo Network IP Gateway— IP
SystemInfoItem/networkArray/networkInfo/ipGatewayArray/ipGateway
SystemInfo Patch Level— string
SystemInfoItem/patchLevel
SystemInfo Primary IPv4 Address— IP
SystemInfoItem/primaryIpv4Address
SystemInfo Primary IP Address— IP
SystemInfoItem/primaryIpAddress
SystemInfo Virtualization— string
SystemInfoItem/procConfigInfo/virtualization
SystemInfo VM Guest— string
SystemInfoItem/procConfigInfo/vmGuest
SystemInfo Proc Type— string
SystemInfoItem/procType
SystemInfo Processor— string
SystemInfoItem/processor
SystemInfo Product ID— string
SystemInfoItem/productID
SystemInfo Product Name— string
SystemInfoItem/productName
SystemInfo Registered Org— string
SystemInfoItem/regOrg
SystemInfo Registered Owner— string
SystemInfoItem/regOwner
SystemInfo State Agent Status— string
SystemInfoItem/stateAgentStatus
SystemInfo Timezone— string
SystemInfoItem/timezone
SystemInfo Timezone DST— string
SystemInfoItem/timezoneDST
SystemInfo Timezone Standard— string
SystemInfoItem/timezoneStandard
SystemInfo Total Physical— int
SystemInfoItem/totalphysical
SystemInfo Uptime— string
SystemInfoItem/uptime
SystemInfo User— string
SystemInfoItem/user
SystemRestore Acl Change Security ID— string
SystemRestoreItem/AclChangeSecurityID
SystemRestore Acl Change Username— string
SystemRestoreItem/AclChangeUsername
SystemRestore Backup Filename— string
SystemRestoreItem/BackupFileName
SystemRestore Change Event— string
SystemRestoreItem/ChangeEvent
SystemRestore ChangeLog Entry Flags— string
SystemRestoreItem/ChangeLogEntryFlags
SystemRestore ChangeLog Seq. Number— int
SystemRestoreItem/ChangeLogEntrySequenceNumber
SystemRestore ChangeLog Entry Type— string
SystemRestoreItem/ChangeLogEntryType
SystemRestore ChangeLog Filename— string
SystemRestoreItem/ChangeLogFileName
SystemRestore Created— date
SystemRestoreItem/Created
SystemRestore Debug Info Process ID— int
SystemRestoreItem/DebugInfoProcessId
SystemRestore Debug Info Process Name— string
SystemRestoreItem/DebugInfoProcessName
SystemRestore Debug Info Thread ID— int
SystemRestoreItem/DebugInfoThreadId
SystemRestore Debug Info Timestamp— date
SystemRestoreItem/DebugInfoTimeStamp
SystemRestore File Attributes— string
SystemRestoreItem/FileAttributes
SystemRestore New Filename— string
SystemRestoreItem/NewFileName
SystemRestore Original Filename— string
SystemRestoreItem/OriginalFileName
SystemRestore Original Short FileName— string
SystemRestoreItem/OriginalShortFileName
SystemRestore Original Volume Path— string
SystemRestoreItem/OriginalVolumePath
SystemRestore Process Name— string
SystemRestoreItem/ProcessName
SystemRestore Registry Hives— string
SystemRestoreItem/RegistryHives/String
SystemRestore Description— string
SystemRestoreItem/RestorePointDescription
SystemRestore Full Path— string
SystemRestoreItem/RestorePointFullPath
SystemRestore Restore Point Name— string
SystemRestoreItem/RestorePointName
SystemRestore Type— string
SystemRestoreItem/RestorePointType
Task Account Logon Type— string
TaskItem/AccountLogonType
Task Account Name— string
TaskItem/AccountName
Task Account Run Level— string
TaskItem/AccountRunLevel
Task Action Type— string
TaskItem/ActionList/Action/ActionType
Task Action COM Class Id— string
TaskItem/ActionList/Action/COMClassId
Task Action COM Data— string
TaskItem/ActionList/Action/COMData
Task Action Digital Signature Certificate Issuer— string
TaskItem/ActionList/Action/DigitalSignature/CertificateIssuer
Task Action Digital Signature Certificate Subject— string
TaskItem/ActionList/Action/DigitalSignature/CertificateSubject
Task Action Digital Signature Description— string
TaskItem/ActionList/Action/DigitalSignature/Description
Task Action Digital Signature Signature Exists— bool
TaskItem/ActionList/Action/DigitalSignature/SignatureExists
Task Action Digital Signature Signature Verified— bool
TaskItem/ActionList/Action/DigitalSignature/SignatureVerified
Task Action Email Attachments— string
TaskItem/ActionList/Action/EmailAttachments
Task Action Email BCC— string
TaskItem/ActionList/Action/EmailBCC
Task Action Email Body— string
TaskItem/ActionList/Action/EmailBody
Task Action Email CC— string
TaskItem/ActionList/Action/EmailCC
Task Action Email From— string
TaskItem/ActionList/Action/EmailFrom
Task Action Email ReplyTo— string
TaskItem/ActionList/Action/EmailReplyTo
Task Action Email Server— string
TaskItem/ActionList/Action/EmailServer
Task Action Email Subject— string
TaskItem/ActionList/Action/EmailSubject
Task Action Email To— string
TaskItem/ActionList/Action/EmailTo
Task Action Exec Arguments— string
TaskItem/ActionList/Action/ExecArguments
Task Action Exec Program MD5— md5
TaskItem/ActionList/Action/ExecProgramMd5sum
Task Action Exec Program Path— string
TaskItem/ActionList/Action/ExecProgramPath
Task Action Exec Program Sha1sum— sha1
TaskItem/ActionList/Action/ExecProgramSha1sum
Task Action Exec Program Sha256sum— sha256
TaskItem/ActionList/Action/ExecProgramSha256sum
Task Action Exec Working Directory— string
TaskItem/ActionList/Action/ExecWorkingDirectory
Task Action Show Message Body— string
TaskItem/ActionList/Action/ShowMessageBody
Task Action Show Message Title— string
TaskItem/ActionList/Action/ShowMessageTitle
Task Application Name— string
TaskItem/ApplicationName
Task Certificate Issuer— string
TaskItem/CertificateIssuer
Task Certificate Subject— string
TaskItem/CertificateSubject
Task Comment— string
TaskItem/Comment
Task Creation Date— date
TaskItem/CreationDate
Task Creator— string
TaskItem/Creator
Task Exit Code— string
TaskItem/ExitCode
Task Flag— string
TaskItem/Flag
Task Max Run Time— string
TaskItem/MaxRunTime
Task Most Recent Run Time— date
TaskItem/MostRecentRunTime
Task Name— string
TaskItem/Name
Task Next Run Time— date
TaskItem/NextRunTime
Task Parameters— string
TaskItem/Parameters
Task Priority— string
TaskItem/Priority
Task Signature Description— string
TaskItem/SignatureDescription
Task Signature Exists— string
TaskItem/SignatureExists
Task Signature Verified— bool
TaskItem/SignatureVerified
Task Status— string
TaskItem/Status
Task Trigger Begin— date
TaskItem/TriggerList/Trigger/TriggerBegin
Task Trigger Delay— string
TaskItem/TriggerList/Trigger/TriggerDelay
Task Trigger Enabled— bool
TaskItem/TriggerList/Trigger/TriggerEnabled
Task Trigger End— string
TaskItem/TriggerList/Trigger/TriggerEnd
Task Trigger Frequency— string
TaskItem/TriggerList/Trigger/TriggerFrequency
Task Trigger Max Run Time — string
TaskItem/TriggerList/Trigger/TriggerMaxRunTime
Task Trigger Session Change Type— string
TaskItem/TriggerList/Trigger/TriggerSessionChangeType
Task Trigger Subscription— string
TaskItem/TriggerList/Trigger/TriggerSubscription
Task Trigger Username— string
TaskItem/TriggerList/Trigger/TriggerUsername
Task Trigger Value Queries— string
TaskItem/TriggerList/Trigger/TriggerValueQueries
Task Virtual Path— string
TaskItem/VirtualPath
Task Work Data— string
TaskItem/WorkItemData
Task Working Directory— string
TaskItem/WorkingDirectory
Task MD5— md5
TaskItem/md5sum
Task Sha1sum— sha1
TaskItem/sha1sum
Task Sha256sum— sha256
TaskItem/sha256sum
UrlHistory Browser Name— string
UrlHistoryItem/BrowserName
UrlHistory Browser Version— string
UrlHistoryItem/BrowserVersion
UrlHistory First Bookmark Date— string
UrlHistoryItem/FirstBookmarkDate
UrlHistory First Visit Date— date
UrlHistoryItem/FirstVisitDate
UrlHistory Hidden— string
UrlHistoryItem/Hidden
UrlHistory Host Name— string
UrlHistoryItem/HostName
UrlHistory Indexed Content— string
UrlHistoryItem/IndexedContent
UrlHistory Last Visit Date— date
UrlHistoryItem/LastVisitDate
UrlHistory Last Visit Date Local— date
UrlHistoryItem/LastVisitDateLocal
UrlHistory Page Title— string
UrlHistoryItem/PageTitle
UrlHistory Profile— string
UrlHistoryItem/Profile
UrlHistory Thumbnail— string
UrlHistoryItem/Thumbnail
UrlHistory Typed— string
UrlHistoryItem/Typed
UrlHistory URL— string
UrlHistoryItem/URL
UrlHistory Username— string
UrlHistoryItem/Username
UrlHistory Visit Count— int
UrlHistoryItem/VisitCount
UrlHistory Visit From— string
UrlHistoryItem/VisitFrom
UrlHistory Visit Type— string
UrlHistoryItem/VisitType
User Last Login— date
UserItem/LastLogin
User Security ID— string
UserItem/SecurityID
User Security Type— string
UserItem/SecurityType
User Name— string
UserItem/Username
User Description— string
UserItem/description
User Disabled— bool
UserItem/disabled
User Fullname— string
UserItem/fullname
string User Group Name — string
UserItem/grouplist/groupname
User Home Directory— string
UserItem/homedirectory
User Lockedout— bool
UserItem/lockedout
User Password Required— string
UserItem/passwordrequired
User Script Path— string
UserItem/scriptpath
User Password Age— string
UserItem/userpasswordage
Volume Actual Available Allocation Units— int
VolumeItem/ActualAvailableAllocationUnits
Volume Bytes Per Sector— int
VolumeItem/BytesPerSector
Volume Creation Time— date
VolumeItem/CreationTime
Volume Device Path— string
VolumeItem/DevicePath
Volume Drive Letter— string
VolumeItem/DriveLetter
Volume File System Flags— string
VolumeItem/FileSystemFlags
Volume File System Name— string
VolumeItem/FileSystemName
Volume Is Mounted— bool
VolumeItem/IsMounted
Volume Name— string
VolumeItem/Name
Volume Sectors Per Allocation Unit— string
VolumeItem/SectorsPerAllocationUnit
Volume Serial Number— string
VolumeItem/SerialNumber
Volume Total Allocation Units— string
VolumeItem/TotalAllocationUnits
Volume Type— string
VolumeItem/Type
Volume Name— string
VolumeItem/VolumeName
Yara Rule— string
Yara/Yara
Event Address Notification Event Address— IP
eventItem/addressNotificationEvent/address
Event Address Notification Event Timestamp— date
eventItem/addressNotificationEvent/timestamp
Event Details Detail Name— string
eventItem/details/detail/name
Event Details Detail Value— string
eventItem/details/detail/value
Event DNS Lookup Event Hostname— string
eventItem/dnsLookupEvent/hostname
Event DNS Lookup Event PID— int
eventItem/dnsLookupEvent/pid
Event DNS Lookup Event Process— string
eventItem/dnsLookupEvent/process
Event DNS Lookup Event Timestamp— date
eventItem/dnsLookupEvent/timestamp
Event Type— string
eventItem/eventType
Event File Write Event Closed— bool
eventItem/fileWriteEvent/closed
Event File Write Event Data At Lowest Offset— string
eventItem/fileWriteEvent/dataAtLowestOffset
Event File Write Event Device Path— string
eventItem/fileWriteEvent/devicePath
Event File Write Event Drive— string
eventItem/fileWriteEvent/drive
Event File Write Event File Extension— string
eventItem/fileWriteEvent/fileExtension
Event File Write Event File Name— string
eventItem/fileWriteEvent/fileName
Event File Write Event File Path— string
eventItem/fileWriteEvent/filePath
Event File Write Event Full Path— string
eventItem/fileWriteEvent/fullPath
Event File Write Event Lowest File Offset Seen— int
eventItem/fileWriteEvent/lowestFileOffsetSeen
Event File Write Event MD5— md5
eventItem/fileWriteEvent/md5
Event File Write Event Num Bytes Seen Written— int
eventItem/fileWriteEvent/numBytesSeenWritten
Event File Write Event PID— int
eventItem/fileWriteEvent/pid
Event File Write Event Process— string
eventItem/fileWriteEvent/process
Event File Write Event Size— int
eventItem/fileWriteEvent/size
Event File Write Event Text At Lowest Offset— string
eventItem/fileWriteEvent/textAtLowestOffset
Event File Write Event Timestamp— date
eventItem/fileWriteEvent/timestamp
Event File Write Event Writes— int
eventItem/fileWriteEvent/writes
Event Image Load Event Device Path— string
eventItem/imageLoadEvent/devicePath
Event Image Load Event Drive— string
eventItem/imageLoadEvent/drive
Event Image Load Event File Extension— string
eventItem/imageLoadEvent/fileExtension
Event Image Load Event File Name— string
eventItem/imageLoadEvent/fileName
Event Image Load Event File Path— string
eventItem/imageLoadEvent/filePath
Event Image Load Event Full Path— string
eventItem/imageLoadEvent/fullPath
Event Image Load Event Parent PID— int
eventItem/imageLoadEvent/parentPid
Event Image Load Event PID— int
eventItem/imageLoadEvent/pid
Event Image Load Event Process— string
eventItem/imageLoadEvent/process
Event Image Load Event Timestamp— date
eventItem/imageLoadEvent/timestamp
Event Image Load Event Username— string
eventItem/imageLoadEvent/username
Event IPv4 Network Event Local IP— IP
eventItem/ipv4NetworkEvent/localIP
Event IPv4 Network Event Local Port— int
eventItem/ipv4NetworkEvent/localPort
Event IPv4 Network Event PID— int
eventItem/ipv4NetworkEvent/pid
Event IPv4 Network Event Process— string
eventItem/ipv4NetworkEvent/process
Event IPv4 Network Event Protocol— string
eventItem/ipv4NetworkEvent/protocol
Event IPv4 Network Event Remote IP— IP
eventItem/ipv4NetworkEvent/remoteIP
Event IPv4 Network Event Remote Port— int
eventItem/ipv4NetworkEvent/remotePort
Event IPv4 Network Event Timestamp— date
eventItem/ipv4NetworkEvent/timestamp
Event Process Event Event Type— string
eventItem/processEvent/eventType
Event Process Event MD5— md5
eventItem/processEvent/md5
Event Process Event Parent PID— int
eventItem/processEvent/parentPid
Event Process Event Parent Process— string
eventItem/processEvent/parentProcess
Event Process Event Parent Process Path— string
eventItem/processEvent/parentProcessPath
Event Process Event PID— int
eventItem/processEvent/pid
Event Process Event Process— string
eventItem/processEvent/process
Event Process Event Process Path— string
eventItem/processEvent/processPath
Event Process Event Start Time— date
eventItem/processEvent/startTime
Event Process Event Timestamp— date
eventItem/processEvent/timestamp
Event Process Event Username— string
eventItem/processEvent/username
Event Reg Key Event Event Type— string
eventItem/regKeyEvent/eventType
Event Reg Key Event Hive— string
eventItem/regKeyEvent/hive
Event Reg Key Event Key Path— string
eventItem/regKeyEvent/keyPath
Event Reg Key Event Original Path— string
eventItem/regKeyEvent/originalPath
Event Reg Key Event Path— string
eventItem/regKeyEvent/path
Event Reg Key Event PID— string
eventItem/regKeyEvent/pid
Event Reg Key Event Process— string
eventItem/regKeyEvent/process
Event Reg Key Event Text— string
eventItem/regKeyEvent/text
Event Reg Key Event Timestamp— string
eventItem/regKeyEvent/timestamp
Event Reg Key Event Value— string
eventItem/regKeyEvent/value
Event Reg Key Event Value Name— string
eventItem/regKeyEvent/valueName
Event Reg Key Event Value Type— string
eventItem/regKeyEvent/valueType
Event URL Monitor Event Hostname— string
eventItem/urlMonitorEvent/hostname
Event URL Monitor Event HTTP Header— string
eventItem/urlMonitorEvent/httpHeader
Event URL Monitor Event Local Port— int
eventItem/urlMonitorEvent/localPort
Event URL Monitor Event PID— int
eventItem/urlMonitorEvent/pid
Event URL Monitor Event Process— string
eventItem/urlMonitorEvent/process
Event URL Monitor Event Process Path— string
eventItem/urlMonitorEvent/processPath
Event URL Monitor Event Remote IP Address— IP
eventItem/urlMonitorEvent/remoteIpAddress
Event URL Monitor Event Remote Port— int
eventItem/urlMonitorEvent/remotePort
Event URL Monitor Event Request URL— string
eventItem/urlMonitorEvent/requestUrl
Event URL Monitor Event Timestamp— date
eventItem/urlMonitorEvent/timestamp
Event URL Monitor Event URL Method— string
eventItem/urlMonitorEvent/urlMethod
Event URL Monitor Event User Agent— string
eventItem/urlMonitorEvent/userAgent
Event URL Monitor Event Username— string
eventItem/urlMonitorEvent/username
Event Timestamp— date
eventItem/timestamp