category

string

The subject of an observation.

class

string

confidence

string

The confidence in the model output to what was attempted to be observed.

context

string

A set of key value pairs providing additional details for this specific observation occurrence.

customer_id

string

The code of the account that owns the event.

dst_ip

string

The IP of the responder to the connection.

dst_ip_enrichments

ip_enrichments

Enrichments for an IP.

event_type

string

The type of event recorded.

evidence_end_timestamp

string

The timestamp for which the flagged activity ended.

evidence_iql

string

An IQL statement that attempts to identify the events used to generate the observation.

evidence_start_timestamp

string

The timestamp for which the flagged activity began.

geo_distance

number

The difference between src and dstgeovalues.

intel

intel[]

Intel that matched entities in the event.

observation_uuid

string

A unique identifier for the model used to generate the observation. Multiple models may exist for the same title.

sensor_id

string

The sensor that created the event.

sensor_ids

string[]

A list of sensors from which activity was used as part of the observation.

source

string

The source of the event.

src_ip

string

The IP of the initiator of the connection.

src_ip_enrichments

ip_enrichments

Enrichments for an IP.

timestamp

string

The time at which traffic for the event began.

title

string

The title of what was attempted to be detected (similar to a suricata sig name).

uuid

string

A unique identifier for the event.