Host Fields

Host Fields
Field Name Example Values Field Type Notes
host_hostname corpdc01, corpdc01.local, lab01.corpdomain.com keyword (normalized:loweronly) NetBIOS or dns hostname
host_id   keyword Host unique identifier (e.g. SID for Microsoft)
host_ip 10.1.2.3, fe80:5cc3:11:4::2c ip IPv4 and IPv6 addresses
host_mac 02:a1:f9:c2:d5:04 keyword MAC address of host, colon-delimited and lower case
host_reference 127.0.0.1, corpdc01, corpdc01.local, lab01.corpdomain.com keyword (normalized:loweronly) Mapped from host_ip or host_hostname in that order - allows a common field to reference for messages that do not provide both (note: CIDR search will not work against this field)
host_type_version   keyword Operating sytem version of host
host_virtfw_hostname   keyword/loweronly For firewalls that operate as partitioned services this is the name of the logical device
host_virtfw_id   keyword For firewalls that operate as partitioned services this is the ID value of the logical device
host_virtfw_uid   keyword Unique identifier such as a UUID value representing a virtual host
Derived and Enriched Fields (values will be derived or added from external sources)
Field Name Example Values Field Type Notes
host_as_*     See: as_* fields
host_category   keyword Future: from entity mapping
host_geo_*     See: geo_* fields
host_location_name Chicago, US, Datacenter 01, Bismark - Finance keyword Field is derived either from an internal enterprise network definition or the Geo location fields if availble
host_priority critical, high, medium, low, informational keyword Future: from entity mapping
host_priority_level 2 byte Future: from entity mapping: 1 = Critical, 2 = High, 3 = Medium, 4 = Low, 5 = Informational
host_type   keyword Machine “type”