Token reference

The following table shows the endpoint operating system platforms each token supports and whether an exhaustive search is required, optional or not applicable. Click on the token name to get more information.

Token	Windows	macOS	Linux	Exhaustive Search
Application Name	No	Yes		---
Browser Name	Yes	Yes		---
Browser Version	Yes	Yes		---
Cookie Flags	Yes	No		---
Cookie Name	Yes	Yes		---
Cookie Value	Yes	Yes		---
DNS Hostname	Yes	Yes		---
Driver Device Name	Yes	No		Required
Driver Module Address	No	No	Yes	Yes
Driver Module In-Tree	No	No	Yes	Yes
Driver Module License	No	No	Yes	Yes
Driver Module Name	Yes	No	Yes	Required
Driver Module Parameters	No	No	Yes	Yes
Driver Module Return Trampoline	No	No	Yes	Yes
Driver Module Signature	No	No	Yes	Yes
Driver Module Signer	No	No	Yes	Yes
Driver Module Signing Hash Algorithm	No	No	Yes	Yes
Driver Module Signing Key	No	No	Yes	Yes
Driver Module Status	No	No	Yes	Yes
Driver Module Vermagic	No	No	Yes	Yes
Driver Module Version	No	No	Yes	Yes
Executable Exported Dll Name	Yes	No		Required
Executable Exported Function Name	Yes	No		Required
Executable Imported Function Name	Yes	No		Required
Executable Imported Module Name	Yes	No		Required
Executable Injected	Yes	No		Required
Executable PE Type	Yes	No		Required
Executable Resource Name	Yes	No		Required
File Attributes	Yes	Yes		Required
File Certificate Issuer	Yes	Yes		Optional (Windows only)
File Certificate Subject	Yes	Yes		Optional (Windows only)
File Download Mime Type	Yes	No		---
File Download Referrer	Yes	Yes		---
File Download Type	Yes	Yes		---
File Full Path	Yes	Yes		Optional
File MD5 Hash	Yes	Yes		Optional
File Name	Yes	Yes		Optional
File SHA1 Hash	Yes	Yes		Optional
File SHA256 Hash	Yes	Yes		Optional
File Signature Exists	Yes	Yes		Optional (Windows only)
File Signature Verified	Yes	Yes		Optional (Windows only)
File Stream Name	Yes	No		Required
File Text Written	Yes	No		---
Group By (grid mode)	Yes	Yes		---
Group ID	No	No	Yes (Quick)	---
Group Name	Yes	Yes	Yes (Quick)	---
Host Set	Yes	Yes		---
Hostname	No	Yes		Required
HTTP Header	Yes	Yes		---
INode	No	No	Yes	Yes
IP Address	Yes	Yes		---
Local IP Address	Yes	Yes		---
Local Port	Yes	Yes		---
Login Failed	No	No	Yes	Yes
Login Record Type	No	No	Yes	Yes
Network Route Flags	No	No	Yes (Quick)	---
Parent Process Name	Yes	Yes		---
Parent Process Path	Yes	Yes		---
Port	Yes	Yes		---
Port Protocol	Yes	Yes		---
Port State	Yes	Yes		---
Process Arguments	Yes	Yes		Optional
Process Name	Yes	Yes		Optional
Quarantine Event Sender Address	No	Yes		---
Quarantine Event Sender Name	No	Yes		---
Registry Key Full Path	Yes	No		Optional
Registry Key Value Name	Yes	No		Optional
Registry Key Value Text	Yes	No		Optional
Remote IP Address	Yes	Yes		---
Remote Login	No	No	Yes	Yes
Remote Port	Yes	Yes		---
Service DLL	Yes	No		---
Service Mode	Yes	Yes		---
Service Name	Yes	Yes		---
Service Status	Yes	Yes		---
Service Type	Yes	Yes		---
Session Length	No	No	Yes	Yes
Shell Command	No	No	Yes	Yes
Shell Type	No	No	Yes	Yes
Size in bytes	Yes	Yes		Optional
Socket Protocol	No	No	Yes	Yes
Socket State	No	No	Yes	Yes
Socket Type	No	No	Yes	Yes
Sudo Command	No	No	Yes	Yes
Sudo Command Success	No	No	Yes	Yes
Syslog Event ID	No	Yes		Required
Syslog Event Message	No	Yes		Required
Syslog Facility	No	Yes		Required
Syslog File	No	No	Yes	Yes
Syslog Sender	No	Yes		Required
Syslog Severity Level	No	Yes		Required
Task Flag	Yes	No		---
Task Name	Yes	Yes		---
Task Reference	No	Yes		---
Task Status	Yes	No		---
Terminal Type	No	No	Yes	Yes
Timestamp - Accessed	Yes	Yes		Optional
Timestamp - Changed	Yes	Yes		Required
Timestamp - Created	Yes	Yes		Optional
Timestamp - Event	Yes	Yes		---
Timestamp - Last Login	Yes	Yes		---
Timestamp - Last Run	Yes	Yes		---
Timestamp - Modified	Yes	Yes		Optional (Windows and macOS. Registry and Windows event record searches for Windows only.)
Timestamp - Started	Yes	Yes		Optional
URL	Yes	Yes		---
Username	Yes	Yes		Optional (Windows and macOS. Registry and Windows event record searches for Windows only.)
Web Page Origin URL	No	Yes		---
Web Page Title	Yes	Yes		---
Windows Event ID	Yes	No		Required
Windows Event Log Type	Yes	No		Required
Windows Event Message	Yes	No		Required