Schema Field Reference Guide

See also:

Reference Tables Guide for how to create and manage reference tables.
Create and Deploy Detection Rules for more information about detection rules.

Last updated: September 29th, 2026

What This Guide Contains

Fields are organized by category. Each field includes:

Field name for use in detection rule logic
Description of what the field contains
Providers that populate this field

Provider Coverage

The Providers field shows which security tools populate each field:

crowdstrike - CrowdStrike Falcon
sentinel_one - SentinelOne
microsoft_defender - Microsoft Defender for Endpoint
jamf_protect - Jamf Protect
elastic - Elastic Defend
okta - Okta
duo - Duo Security
falco - Falco Cloud Security
cloudtrail - AWS CloudTrail
azure_event_hub - Microsoft Entra ID (Azure AD)
gcp_pubsub - Google Cloud Platform

Use this information to ensure fields are populated by your active integrations before building detection rules around them.

Field Categories

Cloud Infrastructure

58 fields - Cloud provider context, API operations, and container runtime details. Includes AWS CloudTrail events, Azure/GCP API activity, container orchestration, and cloud account metadata.

Identity & Authentication

28 fields - User identity, authentication protocols, and actor context. Includes user attributes, session details, effective permissions, authentication protocols, and Kerberos ticket encryption.

Process Execution

43 fields - Process and script execution details including command lines, hashes, parent-child relationships, code signatures, and script content.

37 fields - Network connections, DNS queries, HTTP requests, and TLS sessions. Includes source/destination IPs, domains, geolocation, DNS resolution chains, HTTP user agents, and TLS certificates.

Endpoints & Devices

30 fields - Host identity and peripheral devices. Includes hostname, IP, OS details, hardware serial numbers, USB devices, removable media, and device characteristics.

File Activity

16 fields - File operations and transfers including names, paths, hashes, extensions, mount operations, renames, and FTP/SFTP transfers.

Software

14 fields - Installed software and browser extensions including names, versions, vendors, permissions, installation methods, and product codes.

Windows Registry

12 fields - Windows registry operations including hives, keys, values, and data types.

Findings

6 fields - Security alert metadata including MITRE ATT&CK techniques, severity, detection sources, and alert titles.

General

29 fields - Cross-cutting event fields including event type, provider, activity name, status, severity, logon types, privileges, MFA flags, user/group identifiers, resource names, and email threat indicators.