Destination Fields

Destination Fields
Field Name Example Values Field Type Notes
destination_application_name facebook, twitter keyword Describes the target application
destination_domain corp.local keyword (normalized:loweronly) Destination domain context
destination_bytes_sent   long Network bytes sent by destination to the source. Some sources may present this as source bytes received, bytes received, or similar.
destination_hostname   keyword (normalized:loweronly)  
destination_ip, fe80:5cc3:11:4::2c ip IPv4 and IPv6 addresses
destination_nat_ip, fe80:5cc3:11:4::2c ip  
destination_nat_port 2356 integer  
destination_packets_sent 73458324 long Number of packets delivered to the destination endpoint
destination_port 80 integer  
destination_vsys_uuid   keyword  
destination_zone   keyword  
Derived and Enriched Fields (values will be derived or added from external sources)
Field Name Example Values Field Type Notes
destination_as_*     See: as_* fields
destination_category   keyword Future: from entity mapping
destination_geo_*     See: geo_* fields
destination_location_name Chicago, US, Datacenter 01, Bismark - Finance keyword Field is derived either from an internal enterprise network definition or the Geo location fields if availble
destination_mac a0:b4:44:01:a9:d1 keyword MAC address of host, colon-delimited and lower case
destination_priority critical, high, medium, low, informational keyword Future: from entity mapping
destination_priority_level 1-4 byte 1 = Critical, 2 = High, 3 = Medium, 4 = Low, 5 = Informational
destination_reference IPv4, IPv6, hostname,fqdn keyword (normalized:loweronly) Mapped from source_ip or source_hostname in that order