Schema: Endpoints & Devices
Host identity and peripheral devices. Includes hostname, IP, OS details, hardware serial numbers, USB devices, removable media, and device characteristics.
30 fields available
[← Back to Schema Field Reference](https://docs.nebulock.io/docs/schema-field-reference-guide)
endpoint.browser
endpoint.browserBrowser used by the user on the endpoint (e.g., CHROME, FIREFOX, SAFARI).
Providers: okta
endpoint.hostname
endpoint.hostnameDEPRECATED — unmapped column. No IM mapping populates this field (0% across all providers). Use endpoint.name instead, which is populated by all EDR/IAM providers via ComputerName/host.hostname/DeviceName.
Providers: Not specified
endpoint.hw_info.serial_number
endpoint.hw_info.serial_numberDevice manufacturer serial number. OCSF: device.hw_info.serial_number.
Providers: jamf_protect
endpoint.ip
endpoint.ipIP address of the endpoint host.
Providers: crowdstrike,sentinel_one,microsoft_defender,jamf_protect,elastic
endpoint.mac
endpoint.macMAC address of a network adapter belonging to the managed endpoint itself, from the device network adapter inventory. Note the format differs from source.network_endpoint.mac / destination.network_endpoint.mac, which come from Zeek and are colon-separated lowercase; normalize before comparing the two.
Providers: azure_event_hub
endpoint.mac_vendor
endpoint.mac_vendorVendor or manufacturer of the endpoint network interface controller, resolved from the MAC OUI. Matches the OCSF endpoint.mac_vendor attribute.
Providers: azure_event_hub
endpoint.name
endpoint.nameNormalized short hostname of the endpoint (domain suffix stripped, uppercased). Normalized at ingest via normalizeHostname() JMESPath function for cross-provider correlation. This is the correct field for hostname-based filtering — endpoint.hostname is unmapped. Not populated by Okta (no hostname field in System Log API).
Providers: crowdstrike,sentinel_one,microsoft_defender,jamf_protect,elastic,microsoft_entra,duo
endpoint.name.raw
endpoint.name.rawOriginal endpoint hostname as provided by the vendor (may include FQDN domain suffix, original casing). Preserves the raw value before normalizeHostname() normalization.
Providers: microsoft_defender,microsoft_entra
endpoint.network_interface.type
endpoint.network_interface.typeLink type of the endpoint network adapter. Gives wired-versus-wireless and dual-homing visibility. Named after the OCSF network_interface object. Stored as the raw Defender value (for example Ethernet, Wireless80211), NOT normalized to the OCSF network_interface.type enum -- match on the raw strings.
Providers: azure_event_hub
endpoint.os.architecture
endpoint.os.architectureCPU architecture of the endpoint (e.g., x86_64, arm64). Populated by: MDE (OSArchitecture). Not populated by Elastic Defend (raw field absent).
Providers: microsoft_defender
endpoint.os.raw
endpoint.os.rawOriginal endpoint OS platform value from provider prior to normalizeOS(). For Microsoft Defender this prefers OSPlatform1 (join-preserved raw) with fallback to OSPlatform.
Providers: microsoft_defender
endpoint.os.type
endpoint.os.typeNormalized OS platform short code. Canonical values: Win, Mac, Lin, iOS, Android. Normalized at ingest via normalizeOS() JMESPath function.
Providers: crowdstrike,sentinel_one,microsoft_defender,jamf_protect,elastic
endpoint.os.version
endpoint.os.versionOperating system version as a raw string. Populated by: MDE (OSVersion), SentinelOne (mgmt.osRevision), Jamf Protect (host.os_parsed.version). Not populated by Elastic Defend (raw field absent) or CrowdStrike (no version field in raw events).
Providers: microsoft_defender,sentinel_one,jamf_protect
endpoint.type
endpoint.typeDevice type of the endpoint (e.g., server, desktop, laptop, Computer, Mobile, Tablet). Populated by: SentinelOne (endpoint.type, direct), MDE (DeviceType from DeviceInfo join, all OSes including Linux; falls back to OSPlatform parsing for Windows/macOS), Jamf Protect (defaults to desktop -- macOS server hardware discontinued 2011), Okta (client.device with values: Computer, Mobile, Tablet, Unknown - note: Unknown indicates backend services/API auth, not user devices). Not populated by CrowdStrike (product_type not in streaming events, requires Hosts API enrichment) or Elastic Defend.
Providers: sentinel_one,microsoft_defender,jamf_protect,okta
endpoint.type.raw
endpoint.type.rawOriginal endpoint device type value from provider prior to extractDeviceType() normalization. For Microsoft Defender this prefers DeviceType1 (join-preserved raw) with fallback to DeviceType.
Providers: microsoft_defender
endpoint.uid
endpoint.uidUnique identifier of the endpoint agent (e.g., CrowdStrike AID, SentinelOne agent ID).
Providers: crowdstrike,sentinel_one,microsoft_defender,jamf_protect,elastic
peripheral_device.bus_type
peripheral_device.bus_typeNOCSF extension: Bus type (e.g., USB, PCI-Express, Thunderbolt). CrowdStrike: VolumeBusType, Jamf: event.mount.device.protocol.
Providers: crowdstrike,jamf_protect
peripheral_device.class
peripheral_device.classOCSF: Class of the peripheral device. MDE: ClassName, CrowdStrike: DevicePropertyDeviceDescription.
Providers: crowdstrike,microsoft_defender
peripheral_device.is_ejectable
peripheral_device.is_ejectableNOCSF extension: Whether the device is ejectable. Jamf: event.mount.device.is_ejectable.
Providers: jamf_protect
peripheral_device.is_internal
peripheral_device.is_internalNOCSF extension: Whether the device is internal (e.g., built-in SSD). Jamf: event.mount.device.is_internal.
Providers: jamf_protect
peripheral_device.is_network_volume
peripheral_device.is_network_volumeNOCSF extension: Whether the volume is a network share (e.g., NFS, SMB). Jamf: event.mount.device.is_network_volume.
Providers: jamf_protect
peripheral_device.is_removable
peripheral_device.is_removableNOCSF extension: Whether the device is removable media (e.g., USB). CrowdStrike: IsOnRemovableDisk, Jamf: event.mount.device.is_removable.
Providers: crowdstrike,jamf_protect
peripheral_device.model
peripheral_device.modelOCSF: Peripheral device model. Jamf: event.mount.device.device_model, MDE: DeviceDescription.
Providers: jamf_protect,microsoft_defender
peripheral_device.name
peripheral_device.nameOCSF: Name of the peripheral device.
Providers: crowdstrike
peripheral_device.serial_number
peripheral_device.serial_numberOCSF: Serial number of the peripheral device. CrowdStrike: DevicePropertySerialNumber.
Providers: crowdstrike
peripheral_device.vendor_id_list
peripheral_device.vendor_id_listHardware identifiers reported for the peripheral, each encoding the USB or UMB vendor and product ID. Identifies the device model where no vendor name is available -- Defender reports no vendor name for PnP devices. Not a human-readable vendor; see peripheral_device.vendor_name for that. Named vendor_id_list to match the OCSF peripheral_device attribute, which is likewise a list.
Providers: azure_event_hub,microsoft_defender
peripheral_device.vendor_name
peripheral_device.vendor_nameOCSF: Peripheral device vendor. Jamf: event.mount.device.vendor_name, CrowdStrike: DevicePropertyManufacturer.
Providers: crowdstrike,jamf_protect
peripheral_device.volume.drive_letter
peripheral_device.volume.drive_letterNOCSF extension: Drive letter (Windows only). CrowdStrike: VolumeDriveLetter.
Providers: crowdstrike
peripheral_device.volume.name
peripheral_device.volume.nameNOCSF extension: Display name of the mounted volume. Jamf: event.mount.device.volume_name, CrowdStrike: VolumeName.
Providers: crowdstrike,jamf_protect
peripheral_device.volume.type
peripheral_device.volume.typeNOCSF extension: Filesystem type (e.g., APFS, NTFS, FAT32). Jamf: event.mount.device.volume_type.
Providers: jamf_protect
Updated 12 days ago