source
Contents
source¶
Event fields used to define/normalize the source (client) in a network connection event.
Attributes¶
Name |
Type |
Description |
Sample Value |
|---|---|---|---|
src_bytes |
integer |
The number of bytes sent from the source to the destination for the connection or session. |
|
src_domain_hostname |
string |
The source server, host, hostname, domain, or domain name. Some examples, would include the TLS server name, HTTP Host, DNS Query Name, etc. For information on how to define and use this field refer to the documentation here |
|
src_dvc_action |
string |
If reported by an intermediary device such as a firewall, the action taken by device. |
|
src_dvc_domain |
string |
Name of the domain the device is part of. |
|
src_dvc_fqdn |
string |
The fully qualified domain name of the host |
|
src_dvc_hostname |
string |
The host name from which the event/log came from. There may be multiple host names in an event (i.e. syslog could have forwarder host name), this field is to be the most true log host name (i.e. NOT the forwarders name). |
|
src_dvc_inbound_interface |
string |
If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the source device |
|
src_dvc_interface_guid |
string |
GUID of the network interface which was used for authentication request |
|
src_dvc_interface_name |
string |
the name (description) of the network interface that was used for authentication request. You can get the list of all available network adapters using “ipconfig /all” command |
|
src_dvc_ip_addr |
ip |
IP address assigned to the device generating the event and/or the IP address in the network packet. This could be used in the context of source, destination, device and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
src_dvc_ip_dhcp_assigned_ip_addr |
ip |
IP address assigned by the DHCP server. |
|
src_dvc_ip_is_ipv6 |
boolean |
If IP address is IP version 6 |
|
src_dvc_mac_addr |
string |
MAC address of the device where the event was generated or network interface where a connection starts or ends. |
|
src_dvc_model_name |
string |
The model name of the device |
|
src_dvc_model_number |
string |
The model number of the device |
|
src_dvc_os |
string |
The OS of the device |
|
src_dvc_outbound_interface |
string |
If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the destination device. |
|
src_dvc_type |
string |
The type of the device |
|
src_file_accessed_time |
date |
When the file was last accessed . Also known as |
|
src_file_changed_time |
date |
When the file was last changed. Also known as |
|
src_file_company |
string |
Company name a file belongs to |
|
src_file_creation_time |
date |
When the file was created. Also known as |
|
src_file_description |
string |
Description of a file |
|
src_file_directory |
string |
Directory of file(s). It does not include the file name |
|
src_file_extension |
string |
The extension name or type of the file. |
|
src_file_hard_links |
integer |
Number of hard links |
|
src_file_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_file_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_file_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_file_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_file_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_file_inode |
integer |
Filesystem inode number |
`````` |
src_file_link_name |
string |
path of the hard link |
|
src_file_mime_type |
string |
MIME type name specified for the file |
|
src_file_modified_time |
date |
When the file was last modified. Also known as |
|
src_file_name |
string |
name of the file without its full path. This could be a local file or one transmitted over the network. |
|
src_file_path |
string |
full path of a file including the name of the file. This could be a local file or one transmitted over the network. |
|
src_file_previous_accessed_time |
date |
When the file was previously accessed |
|
src_file_previous_changed_time |
date |
When the file was previously changed |
|
src_file_previous_creation_time |
date |
When the file was previously created |
|
src_file_previous_modified_time |
date |
When the file was previously modified |
|
src_file_previous_name |
string |
The file’s previous name |
|
src_file_previous_path |
string |
The file’s previous path |
|
src_file_product |
string |
The file’s product name |
|
src_file_size |
integer |
Size of the file, in bytes. |
|
src_file_symlink |
integer |
1 if the path is a symlink, otherwise 0 |
|
src_file_symlink_name |
string |
path of the symlink |
|
src_file_system_block_size |
integer |
Block size of filesystem |
`````` |
src_file_system_type |
string |
The file system type, ex: fat32, ntfs, vmfs, ext3, ext4, xfs |
|
src_file_version |
string |
file version. i.e. image loaded version |
|
src_geo_city |
string |
The city associated to the IP address in the network session. |
|
src_geo_continent |
string |
The continent associated with the IP address in the network session. |
|
src_geo_country |
string |
The country associated with the IP address in the network session. |
|
src_geo_country_capital |
string |
The capital of the country associated with the IP address in the network session. |
|
src_geo_country_code |
string |
51 |
|
src_geo_latitude |
string |
The latitude of the geographical coordinate associated with the IP address in the network session. |
|
src_geo_longitude |
string |
The longitude of the geographical coordinate associated with the IP address in the network session. |
|
src_geo_region |
string |
The region within a country associated with the IP address in the network session. |
|
src_interface_guid |
string |
GUID of the network interface which was used for authentication request (if applicable). Most of the time you would use the interface_name field for the uid. |
|
src_interface_name |
string |
The network interface used for the connection or session by the source device. |
|
src_ip_addr |
ip |
IP address assigned to the device generating the event and/or the IP address in the network packet. This could be used in the context of source, destination, device and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
src_ip_dhcp_assigned_ip_addr |
ip |
IP address assigned by the DHCP server. |
|
src_ip_is_ipv6 |
boolean |
If IP address is IP version 6 |
|
src_mac_addr |
string |
MAC address of the device where the event was generated or network interface where a connection starts or ends. |
|
src_mime_type |
string |
Source MIME type as seen in (layer 7) application layer details or as defined by an application scanner such as an anti-virus/EDR. For HTTP this is usually from the server’s “Content-Type” header. https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Complete_list_of_MIME_types |
|
src_packets |
integer |
The number of packets sent from the source to the destination for the connection or session. The meaning of a packet is defined by the reporting device. |
|
src_port_name |
string |
Name of the port used in a network connection. This is usually determined by IANA common port assignment. Therefore, this means its a guess and NOT actually what the application/ is what the actually. |
|
src_port_number |
integer |
Port number used in a network connection. This could be used in the context of source, destination and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
src_process_call_trace |
string |
Stack trace of where open process is called |
```C:\WINDOWS\SYSTEM32\ntdll.dll+a0344 |
src_process_command_line |
string |
Command arguments that were were executed by the process in the endpoint. |
|
src_process_company |
string |
Company name metadata of the Image file |
|
src_process_current_directory |
string |
The full path to the current directory for the process. The string can also specify a UNC path. |
|
src_process_file_description |
string |
Description of the Image file |
|
src_process_file_name |
string |
Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_file_path |
string |
The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. |
|
src_process_file_product |
string |
The Image’s file product name |
|
src_process_file_version |
string |
Version of the Image file |
|
src_process_granted_access |
string |
granted access code requested/used to open a target process |
|
src_process_guid |
string |
Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command. |
|
src_process_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_process_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_process_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_process_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_process_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_process_id |
integer |
Process unique identifier used by the current operating system to identify a process. |
|
src_process_injected_address |
string |
The memory address where the subprocess is injected |
|
src_process_integrity_level |
string |
Integrity label assigned to a process |
|
src_process_is_hidden |
boolean |
Describes if the process is hidden. |
|
src_process_name |
string |
Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_parent_call_trace |
string |
Stack trace of where open process is called |
```C:\WINDOWS\SYSTEM32\ntdll.dll+a0344 |
src_process_parent_command_line |
string |
Command arguments that were were executed by the process in the endpoint. |
|
src_process_parent_company |
string |
Company name metadata of the Image file |
|
src_process_parent_current_directory |
string |
The full path to the current directory for the process. The string can also specify a UNC path. |
|
src_process_parent_file_description |
string |
Description of the Image file |
|
src_process_parent_file_name |
string |
Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_parent_file_path |
string |
The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. |
|
src_process_parent_file_product |
string |
The Image’s file product name |
|
src_process_parent_file_version |
string |
Version of the Image file |
|
src_process_parent_granted_access |
string |
granted access code requested/used to open a target process |
|
src_process_parent_guid |
string |
Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command. |
|
src_process_parent_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_process_parent_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_process_parent_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_process_parent_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_process_parent_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_process_parent_id |
integer |
Process unique identifier used by the current operating system to identify a process. |
|
src_process_parent_injected_address |
string |
The memory address where the subprocess is injected |
|
src_process_parent_integrity_level |
string |
Integrity label assigned to a process |
|
src_process_parent_is_hidden |
boolean |
Describes if the process is hidden. |
|
src_process_parent_name |
string |
Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_resource_group |
string |
The ID of the group to which the source device belongs in a network connection. This might be an AWS account, or an Azure subscription or Resource Group |
|
src_resource_id |
string |
The resource Id of the source device in a network connection |
|
src_user_aadid |
string |
The User Azure AD ID of the identity associated with a cloud network session. It applies to source and destination entities. |
|
src_user_cred_type |
string |
types of credentials which were presented for delegation |
|
src_user_domain |
string |
The domain or computer name associated to the user in a session. In active directory, this would be the name of the domain the user belongs to. |
|
src_user_identity |
string |
User Principal Name (UPN) or another type of account identifier for which 802.1x authentication request was made. |
|
src_user_linked_logon_id |
integer |
A hexadecimal value of the paired logon session. |
|
src_user_logon_authentication_lan_package_name |
string |
The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon. Possible values are: NTLM V1, NTLM V2, LM. Only populated if Authentication Package = NTLM. |
|
src_user_logon_authentication_package_name |
string |
The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “4610: An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “4622: A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. |
|
src_user_logon_device_claims |
string |
list of device claims for new logon session |
|
src_user_logon_elevated_token |
string |
a “Yes” or “No” flag. If “Yes” then the session this event represents is elevated and has administrator privileges. |
|
src_user_logon_guid |
string |
a GUID that can help you correlate this event with another event that can contain the same Logon GUID, “4769(S, F): A Kerberos service ticket was requested event on a domain controller. It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same Logon GUID, “4648(S): A logon was attempted using explicit credentials” and “4964(S): Special groups have been assigned to a new logon.” |
|
src_user_logon_id |
integer |
hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID |
|
src_user_logon_impersonation_level |
string |
Impersonation level |
|
src_user_logon_key_length |
integer |
the length of NTLM Session Security key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “Authentication Package” = “Kerberos”, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using Negotiate authentication package. |
|
src_user_logon_process_name |
string |
The name of the trusted logon process that was used for the logon. See event “4611: A trusted logon process has been registered with the Local Security Authority” description for more information. |
|
src_user_logon_restricted_admin_mode |
string |
Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. If not a RemoteInteractive logon, then this will be “-” string. |
|
src_user_logon_transmitted_services |
string |
the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user - most commonly done by a front-end website to access an internal resource on behalf of a user. |
|
src_user_logon_type |
integer |
the type of logon which was performed |
|
src_user_logon_user_claims |
string |
list of user claims for new logon session. This field contains user claims if user account was logged in and device claims if computer account was logged in |
|
src_user_logon_user_linked_id |
integer |
A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “0x0”. |
|
src_user_logon_virtual_account |
string |
a “Yes” or “No” flag, which indicates if the account is a virtual account (e.g., “Managed Service Account”), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using “NetworkService”. |
|
src_user_name |
string |
Name of the user associated with the main event (i.e. Network session). There could be a sense of direction depending how it is used together with other entities (i.e. src_user_name or dst_user_name) |
|
src_user_network_account_domain |
string |
Domain for the user that will be used for outbound (network) connections. |
|
src_user_network_account_name |
string |
User name used for outbound (network) connections |
|
src_user_password |
string |
User password if seen in the request. Commonly seen in network logs and authentication proxy/logs. |
|
src_user_reporter_domain |
string |
domain name of the user that reported the main event |
|
src_user_reporter_id |
integer |
unique identifier of the user that reported the main event |
|
src_user_reporter_name |
string |
the name of the account that reported information about the main event |
|
src_user_reporter_sid |
string |
SID of account that reported information about the main event |
|
src_user_security_package |
string |
the name of Security Package used during an authentication event. |
|
src_user_session_id |
integer |
ID of the session the user belongs to. |
|
src_user_sid |
string |
Security identifier of the user. Typically, the identity used to authenticate a server. |
|
src_user_sid_list |
string |
the list of special group SIDs, which New Logon\Security ID is a member of. |
|
src_user_upn |
string |
In Active Directory, the User Principal Name (UPN) attribute is a user identifier for logging in, separate from a Windows domain login. |
|
src_vlan_id |
integer |
The Source VLAN ID if it can be determined. Most commonly if from a firewall/switch/router then it can be determined |
|
src_vlan_name |
string |
The Source VLAN Name. Most commonly if from a firewall/switch/router then it can be determined |
|
src_zone |
string |
The network zone of the source, as defined by the reporting device. |
|