Field types
Most fields are atomic, meaning they cannot be broken down further. However, FortiNDR Cloud fields can also be a structured object, either an object or an array. See Enriched object field types.
Fields in FortiNDR Cloud can be one of the following types.
| Field Type | Description | Example |
|---|---|---|
| int | An integer value (port, bytes, packets, etc.) | 1
|
| float | A decimal value (distance, entropy, etc.) | 1.0
|
| Boolean | true of false | True
|
| string | A sequence of arbitrary characters | hello world
|
| timestamp | A RFC3339 timestamp value | 2019-01-01T00:00:00.000Z
|
| ip | A single IP address or valid CIDR-notation | 8.8.8.8, 10.0.1.0/24 |
| object | An arbitrary JSON structure containing nested subfields | N/A |
| array | An array of values of the same type | N/A |