Skip to main content
Sumo Logic

Schema Attributes

This topic defines the attributes in CSE Schema v3.  

accountId

Description Account identifiers used in logs from environments where multiple accounts can be used. This is common for cloud providers like AWS.
Type string
Can be set by mapping True
Enrichment field False

action

Description Action taken by the product.
Type string
Can be set by mapping True
Enrichment field False

application

Description Application that was used by the user based on the log.
Type string
Can be set by mapping True
Enrichment field False

baseImage

Description The base image of a process (ie notepad.exe)
Type string
Can be set by mapping True
Enrichment field False

bytesIn

Description Amount of the data received in bytes.
Type long
Can be set by mapping True
Enrichment field False

bytesOut

Description Amount of the data sent in bytes.
Type long
Can be set by mapping True
Enrichment field False

changeTarget

Description The user account that was affected by a change.
Type string
Can be set by mapping True
Enrichment field False

changeType

Description Category of change the user made.
Type string
Can be set by mapping True
Enrichment field False

commandLine

Description The command run by the user using a shell.
Type string
Can be set by mapping True
Enrichment field False

day

Description Day pulled from the timestamp.
Type int
Can be set by mapping False
Enrichment field False

description

Description The description of the log event.
Type string
Can be set by mapping True
Enrichment field False

device_hostname

Description Fully Qualified Domain Name that uniquely and absolutely names a computer. If name normalization occurs this will be the normalized name.
Type string
Can be set by mapping True
Enrichment field False

device_hostname_raw

Description The raw (un-normalized) version of a hostname.
Type string
Can be set by mapping False
Enrichment field True

device_ip

Description The native assigned IP address of the device.
Type string
Can be set by mapping True
Enrichment field False

device_ip_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

device_ip_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

device_ip_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

device_ip_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

device_ip_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

device_ip_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

device_ip_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_ip_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

device_mac

Description The hardware identification number that uniquely identifies the device on a network
Type string
Can be set by mapping True
Enrichment field False

device_natIp

Description The external IP in cases where the internal IP goes through network address translation.
Type string
Can be set by mapping True
Enrichment field False

device_natIp_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

device_natIp_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

device_natIp_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

device_natIp_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

device_natIp_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

device_natIp_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

device_natIp_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

device_osName

Description Operating system controlling on this device.
Type string
Can be set by mapping True
Enrichment field False

device_uniqueId

Description The source specific identifier for device (if available). This is frequently an instance id in cloud environments.
Type string
Can be set by mapping True
Enrichment field False

dns_query

Description The entire request made from the client machine to the DNS server.
Type string
Can be set by mapping True
Enrichment field False

dns_queryDomain

Description This should be conditionally populated if the DNS request contains a domain.
Type string
Can be set by mapping True
Enrichment field False

dns_queryDomain_alexaRank

Description Domain ranking in the alexa top 10k sites. NULL if not in the list.
Type long
Can be set by mapping False
Enrichment field True

dns_queryDomain_entropyFqdn

Description The entropy calculation of the fqdn field.
Type double
Can be set by mapping False
Enrichment field True

dns_queryDomain_entropyRootDomain

Description The entropy calculation of the rootDomain field.
Type double
Can be set by mapping False
Enrichment field True

dns_queryDomain_entropySubDomain

Description Entropy is the measure of disorder. If this case on the sub domain.
Type double
Can be set by mapping False
Enrichment field True

dns_queryDomain_fqdn

Description The fully qualified domain name (e.g. somehost.sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

dns_queryDomain_possibleDga

Description Whether or not this domain is potentially a Domain Generation Algorithm created domain based on our backend analytics.
Type boolean
Can be set by mapping False
Enrichment field True

dns_queryDomain_possibleDynDns

Description A likely dynamically (not static) IP address associated with this domain.
Type boolean
Can be set by mapping False
Enrichment field True

dns_queryDomain_rootDomain

Description The root domain of hostname in the domain (e.g. sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

dns_queryDomain_tld

Description The top-level-domain field of the domain name (e.g. com, net, org)
Type string
Can be set by mapping False
Enrichment field True

dns_queryType

Description The type of query that was made by the client machine.
Type string
Can be set by mapping True
Enrichment field False

dns_reply

Description The DNS reply which can be a single record or multiple records concatenated into a string.
Type string
Can be set by mapping True
Enrichment field False

dns_replyDomain

Description This should be conditionally populated if the DNS reply is a domain.
Type string
Can be set by mapping True
Enrichment field False

dns_replyDomain_alexaRank

Description Domain ranking in the alexa top 10k sites. NULL if not in the list.
Type long
Can be set by mapping False
Enrichment field True

dns_replyDomain_entropyFqdn

Description The entropy calculation of the fqdn field.
Type double
Can be set by mapping False
Enrichment field True

dns_replyDomain_entropyRootDomain

Description The entropy calculation of the rootDomain field.
Type double
Can be set by mapping False
Enrichment field True

dns_replyDomain_entropySubDomain

Description Entropy is the measure of disorder. If this case on the sub domain.
Type double
Can be set by mapping False
Enrichment field True

dns_replyDomain_fqdn

Description The fully qualified domain name (e.g. somehost.sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

dns_replyDomain_possibleDga

Description Whether or not this domain is potentially a Domain Generation Algorithm created domain based on our backend analytics.
Type boolean
Can be set by mapping False
Enrichment field True

dns_replyDomain_possibleDynDns

Description A likely dynamically (not static) IP address associated with this domain.
Type boolean
Can be set by mapping False
Enrichment field True

dns_replyDomain_rootDomain

Description The root domain of hostname in the domain (e.g. sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

dns_replyDomain_tld

Description The top-level-domain field of the domain name (e.g. com, net, org)
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp

Description This should be conditionally populated if the DNS reply is an IP address.
Type string
Can be set by mapping True
Enrichment field False

dns_replyIp_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

dns_replyIp_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

dns_replyIp_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

dns_replyIp_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dns_replyIp_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dns_replyIp_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dns_replyIp_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

dns_returnCode

Description Code indicating the outcome of a DNS request.
Type string
Can be set by mapping True
Enrichment field False

dstDevice_hostname

Description Fully Qualified Domain Name that uniquely and absolutely names a computer. If name normalization occurs this will be the normalized name.
Type string
Can be set by mapping True
Enrichment field False

dstDevice_hostname_raw

Description The raw (un-normalized) version of a hostname.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip

Description The native assigned IP address of the device.
Type string
Can be set by mapping True
Enrichment field False

dstDevice_ip_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

dstDevice_ip_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

dstDevice_ip_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

dstDevice_ip_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dstDevice_ip_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dstDevice_ip_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_ip_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

dstDevice_mac

Description The hardware identification number that uniquely identifies the device on a network
Type string
Can be set by mapping True
Enrichment field False

dstDevice_natIp

Description The external IP in cases where the internal IP goes through network address translation.
Type string
Can be set by mapping True
Enrichment field False

dstDevice_natIp_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

dstDevice_natIp_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

dstDevice_natIp_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

dstDevice_natIp_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dstDevice_natIp_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

dstDevice_natIp_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

dstDevice_natIp_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

dstDevice_osName

Description Operating system controlling on this device.
Type string
Can be set by mapping True
Enrichment field False

dstDevice_uniqueId

Description The source specific identifier for device (if available). This is frequently an instance id in cloud environments.
Type string
Can be set by mapping True
Enrichment field False

dstPort

Description The destination port for the network transaction.
Type int
Can be set by mapping True
Enrichment field False

email_messageId

Description Unique identifier of the email.
Type string
Can be set by mapping True
Enrichment field False

email_sender

Description Email of the user that sent the email.
Type string
Can be set by mapping True
Enrichment field False

email_subject

Description Subject of the email.
Type string
Can be set by mapping True
Enrichment field False

fields

Description This is a general purpose container for all un-mapped data from the log line.
Type map[string]string
Can be set by mapping False
Enrichment field False

file_basename

Description The base file name plus extension (if present) minus any path components.
Type string
Can be set by mapping True
Enrichment field False

file_hash_imphash

Description File hash created using the IMPHASH algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_hash_md5

Description File hash created using the MD5 algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_hash_pehash

Description File hash created using the PEHASH algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_hash_sha1

Description File hash created using the SHA1 algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_hash_sha256

Description File hash created using the SHA256 algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_hash_ssdeep

Description File hash created using the SSDEEP algorithm.
Type string
Can be set by mapping True
Enrichment field False

file_mimeType

Description Two-part identifier for file formats and format contents transmitted on the Internet.
Type string
Can be set by mapping True
Enrichment field False

file_path

Description The full path (if possible) of the file. This field may contain partial paths and serves as the general place holder for path fields.
Type string
Can be set by mapping True
Enrichment field False

file_size

Description Count of bytes taken up by the file.
Type long
Can be set by mapping True
Enrichment field False

file_uid

Description The data source specific unique identifier for the file.
Type string
Can be set by mapping True
Enrichment field False

flowState

Description The state of the flow when the netflow log was generated.
Type string
Can be set by mapping True
Enrichment field False

friendlyName

Description Name of the table the data is mapped to. Always Record for V3.
Type string
Can be set by mapping False
Enrichment field False

fromUser_authDomain

Description The domain associated with this particular user. (e.g. sumologic.com, sumologic.local)
Type string
Can be set by mapping True
Enrichment field False

fromUser_email

Description The associated email address assigned to this user.
Type string
Can be set by mapping True
Enrichment field False

fromUser_userId

Description The source unique identifier for the user account.
Type string
Can be set by mapping True
Enrichment field False

fromUser_username

Description The name commonly used to identify the user. Does not include domain. If name normalization occurs, this will be the normalized name.
Type string
Can be set by mapping True
Enrichment field False

fromUser_username_raw

Description The raw (un-normalized) version of a username.
Type string
Can be set by mapping False
Enrichment field True

fromUser_username_role

Description The role that is parsed out of the normalized username (usually from an AWS assumed role ARN).
Type string
Can be set by mapping False
Enrichment field True

hour

Description Hour pulled from the timestamp.
Type int
Can be set by mapping False
Enrichment field False

http_contentLength

Description The number of bytes of data in the body of the response.
Type int
Can be set by mapping True
Enrichment field False

http_hostname

Description Hostname from the client request
Type string
Can be set by mapping True
Enrichment field False

http_method

Description Type of request being made. (e.g. GET or POST)
Type string
Can be set by mapping True
Enrichment field False

http_referer

Description Identifies the address of the webpage (i.e. the URI or IRI) which is linked to the resource being requested.
Type string
Can be set by mapping True
Enrichment field False

http_referer_alexaRank

Description The domain's rank among the top 10k sites by Alexa traffic rank. NULL if not in the list.
Type long
Can be set by mapping False
Enrichment field True

http_referer_entropyFqdn

Description The entropy calculation of the fqdn field.
Type double
Can be set by mapping False
Enrichment field True

http_referer_entropyRootDomain

Description The entropy calculation of the rootDomain field.
Type double
Can be set by mapping False
Enrichment field True

http_referer_fqdn

Description The fully qualified domain name in the URL (e.g. somehost.sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

http_referer_path

Description The path component of a URL (e.g. somepath/something)
Type string
Can be set by mapping False
Enrichment field True

http_referer_possibleDga

Description Whether or not this domain is potentially a Domain Generation Algorithm created domain based on our backend analytics.
Type boolean
Can be set by mapping False
Enrichment field True

http_referer_possibleDynDns

Description A likely dynamically (not static) IP address associated with this domain.
Type boolean
Can be set by mapping False
Enrichment field True

http_referer_protocol

Description The URL protocol (e.g. https)
Type string
Can be set by mapping False
Enrichment field True

http_referer_rootDomain

Description The root domain of hostname in the URL (e.g. sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

http_referer_tld

Description The top-level-domain field of the domain name in the URL (e.g. com, net, org)
Type string
Can be set by mapping False
Enrichment field True

http_response_contentLength

Description The number of bytes of data in the body of the response
Type int
Can be set by mapping True
Enrichment field False

http_response_contentType

Description The format of the data in the HTTP response.
Type string
Can be set by mapping True
Enrichment field False

http_response_statusCode

Description The HTTP response code for a request.
Type int
Can be set by mapping True
Enrichment field False

http_response_statusText

Description Contains the status message corresponding to the status code.
Type string
Can be set by mapping True
Enrichment field False

http_url

Description URL that the request is being made to.
Type string
Can be set by mapping True
Enrichment field False

http_url_alexaRank

Description The domain's rank among the top 10k sites by Alexa traffic rank. NULL if not in the list.
Type long
Can be set by mapping False
Enrichment field True

http_url_entropyFqdn

Description The entropy calculation of the fqdn field.
Type double
Can be set by mapping False
Enrichment field True

http_url_entropyRootDomain

Description The entropy calculation of the rootDomain field.
Type double
Can be set by mapping False
Enrichment field True

http_url_fqdn

Description The fully qualified domain name in the URL (e.g. somehost.sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

http_url_path

Description The path component of a URL (e.g. somepath/something)
Type string
Can be set by mapping False
Enrichment field True

http_url_possibleDga

Description Whether or not this domain is potentially a Domain Generation Algorithm created domain based on our backend analytics.
Type boolean
Can be set by mapping False
Enrichment field True

http_url_possibleDynDns

Description A likely dynamically (not static) IP address associated with this domain.
Type boolean
Can be set by mapping False
Enrichment field True

http_url_protocol

Description The URL protocol (e.g. https)
Type string
Can be set by mapping False
Enrichment field True

http_url_rootDomain

Description The root domain of hostname in the URL (e.g. sumologic.com).
Type string
Can be set by mapping False
Enrichment field True

http_url_tld

Description The top-level-domain field of the domain name in the URL (e.g. com, net, org)
Type string
Can be set by mapping False
Enrichment field True

http_userAgent

Description Software agent that is acting on behalf of a user.
Type string
Can be set by mapping True
Enrichment field False

ipProtocol

Description The internet protocol used in the traffic that generated the log event. This should be the IP protocol keyword or the protocol number, such as ICMP or 1, TCP or 6, UDP or 17.
Type string
Can be set by mapping True
Enrichment field False

listMatches

Description Name(s) of the match list(s) that a value in the log matched on.
Type array[string]
Can be set by mapping False
Enrichment field False

logonType

Description The type of authentication or logon that occurred.
Type string
Can be set by mapping True
Enrichment field False

matchedItems

Description Value(s) in the match list(s) that an a value in the log matched on.
Type array[MatchedItem]
Can be set by mapping False
Enrichment field False

metadata_defaultTz

Description Default timezone for timestamp parsing.
Type int
Can be set by mapping False
Enrichment field False

metadata_deviceEventId

Description Event type given by the vendor for the log.
Type string
Can be set by mapping False
Enrichment field False

metadata_mapperName

Description Sumo Logic CSE mapper name used to normalize the log.
Type string
Can be set by mapping False
Enrichment field False

metadata_mapperUid

Description UID for the Sumo Logic CSE mapper used to normalize the log.
Type string
Can be set by mapping False
Enrichment field False

metadata_parseTime

Description The time at which the log line was parsed into a record by the parser and mapper service in milliseconds since epoch.
Type long
Can be set by mapping False
Enrichment field False

metadata_parser

Description The Sumo Logic parser name used on the original log.
Type string
Can be set by mapping False
Enrichment field False

metadata_product

Description The specific product name of the data source. Note the name of the company who created the product is the "vendor" field.
Type string
Can be set by mapping False
Enrichment field False

metadata_productGuid

Description UID for the normalized vendor + product combination for the log.
Type string
Can be set by mapping False
Enrichment field False

metadata_receiptTime

Description The time at which the log line was received by the log sensor in milliseconds since epoch.
Type long
Can be set by mapping False
Enrichment field False

metadata_schemaVersion

Description The current schema version (3).
Type int
Can be set by mapping False
Enrichment field False

metadata_sensorId

Description UID of the Sumo Logic sensor used to ingest the log.
Type string
Can be set by mapping False
Enrichment field False

metadata_sensorZone

Description Optional tagging of sensors used to differentiate the location of the sensor.
Type string
Can be set by mapping False
Enrichment field False

metadata_sourceCategory

Description The Sumo Logic source category of the data.
Type string
Can be set by mapping False
Enrichment field False

metadata_sourceMessageId

Description The _messageID of the original source log message (from SumoLogic).
Type string
Can be set by mapping False
Enrichment field False

metadata_vendor

Description The name of the company responsible for the data source. Note the name of the product is in the "product" field.
Type string
Can be set by mapping False
Enrichment field False

moduleType

Description The type of files loaded by a process to extend functionally such as DLLs.
Type string
Can be set by mapping True
Enrichment field False

month

Description Month pulled from the timestamp.
Type int
Can be set by mapping False
Enrichment field False

normalizedSeverity

Description A normalized severity score, on a 1-5 scale with 1 being Informational and 5 being Critical.
Type int
Can be set by mapping True
Enrichment field False

normalizedSeverity_description

Description A string representing the severity.
Type string
Can be set by mapping False
Enrichment field True

objectType

Description The name of the top level schema object type. (e.g. Authentication, Audit, Endpoint, Network, Notification, etc.)
Type string
Can be set by mapping False
Enrichment field False

packetsIn

Description The count of packets received in a network connection.
Type long
Can be set by mapping True
Enrichment field False

packetsOut

Description The count of packets sent in a network connection.
Type long
Can be set by mapping True
Enrichment field False

parentBaseImage

Description The base image name of a parent process (ie notepad.exe)
Type string
Can be set by mapping True
Enrichment field False

parentCommandLine

Description The command line of a parent process
Type string
Can be set by mapping True
Enrichment field False

parentPid

Description The process id of the program that initiated a process.
Type int
Can be set by mapping True
Enrichment field False

pid

Description The process id of the process itself.
Type int
Can be set by mapping True
Enrichment field False

processUid

Description A unique process identifier provided by the source record.
Type string
Can be set by mapping True
Enrichment field False

resource

Description A generic place holder for the resource being accessed within a log.
Type string
Can be set by mapping True
Enrichment field False

severity

Description The source specific severity level with no normalization.
Type string
Can be set by mapping True
Enrichment field False

sourceUid

Description A UID that is defined by the record itself. Each record is assigned a UID during mapping, but this is the unique identifier field that may exist within an originating record.
Type string
Can be set by mapping True
Enrichment field False

srcDevice_hostname

Description Fully Qualified Domain Name that uniquely and absolutely names a computer. If name normalization occurs this will be the normalized name.
Type string
Can be set by mapping True
Enrichment field False

srcDevice_hostname_raw

Description The raw (un-normalized) version of a hostname.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip

Description The native assigned IP address of the device.
Type string
Can be set by mapping True
Enrichment field False

srcDevice_ip_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

srcDevice_ip_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

srcDevice_ip_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

srcDevice_ip_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

srcDevice_ip_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

srcDevice_ip_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_ip_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

srcDevice_mac

Description The hardware identification number that uniquely identifies the device on a network
Type string
Can be set by mapping True
Enrichment field False

srcDevice_natIp

Description The external IP in cases where the internal IP goes through network address translation.
Type string
Can be set by mapping True
Enrichment field False

srcDevice_natIp_asnNumber

Description An autonomous system number for the IP address based on the MaxMind GeoIP database.
Type int
Can be set by mapping False
Enrichment field True

srcDevice_natIp_asnOrg

Description Organization associated with the IP address address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_city

Description City for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_countryCode

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_countryName

Description Country Code for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_ipv4IntValue

Description The ipv4 address stored as an unsigned 64-bit integer value
Type long
Can be set by mapping False
Enrichment field True

srcDevice_natIp_isInternal

Description Signifies whether the IP address is internal or external. True if internal, False if external.
Type boolean
Can be set by mapping False
Enrichment field True

srcDevice_natIp_isp

Description Internet Service Provider for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_latitude

Description Latitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

srcDevice_natIp_location

Description This value is populated based on the Network Blocks you have uploaded. When there is a match, it will be populated with the network block label.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_longitude

Description Longitude for the IP address based on the MaxMind GeoIP database.
Type float
Can be set by mapping False
Enrichment field True

srcDevice_natIp_region

Description State or Territory for the IP address based on the MaxMind GeoIP database.
Type string
Can be set by mapping False
Enrichment field True

srcDevice_natIp_version

Description The version of IP protocol (e.g. 4 or 6)
Type int
Can be set by mapping False
Enrichment field True

srcDevice_osName

Description Operating system controlling on this device.
Type string
Can be set by mapping True
Enrichment field False

srcDevice_uniqueId

Description The source specific identifier for device (if available). This is frequently an instance id in cloud environments.
Type string
Can be set by mapping True
Enrichment field False

srcPort

Description The port used to initiate a network connection.
Type int
Can be set by mapping True
Enrichment field False

success

Description Boolean value to show whether or not an action was successful.
Type boolean
Can be set by mapping True
Enrichment field False

tcpProtocol

Description Application layer protocol used to establish the connection.
Type string
Can be set by mapping True
Enrichment field False

threat_identifier

Description The identifier or indicator specific to a threat. Generally speaking this should be populated with an indicator value.
Type string
Can be set by mapping True
Enrichment field False

threat_name

Description Name of the threat.
Type string
Can be set by mapping True
Enrichment field False

threat_referenceUrl

Description A external URL that can provide more information about the threat. This should NOT be the URL that represents an observed HTTP request.
Type string
Can be set by mapping True
Enrichment field False

timestamp

Description The timestamp of the event in milliseconds since epoch.
Type long
Can be set by mapping True
Enrichment field False

uid

Description UID for the parsed record in Sumo Logic CSE.
Type string
Can be set by mapping False
Enrichment field False

user_authDomain

Description The domain associated with this particular user. (e.g. sumologic.com, sumologic.local)
Type string
Can be set by mapping True
Enrichment field False

user_email

Description The associated email address assigned to this user.
Type string
Can be set by mapping True
Enrichment field False

user_userId

Description The source unique identifier for the user account.
Type string
Can be set by mapping True
Enrichment field False

user_username

Description The name commonly used to identify the user. Does not include domain. If name normalization occurs, this will be the normalized name.
Type string
Can be set by mapping True
Enrichment field False

user_username_raw

Description The raw (un-normalized) version of a username.
Type string
Can be set by mapping False
Enrichment field True

user_username_role

Description The role that is parsed out of the normalized username (usually from an AWS assumed role ARN).
Type string
Can be set by mapping False
Enrichment field True

vuln_bugtraq

Description BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities.
Type string
Can be set by mapping True
Enrichment field False

vuln_cert

Description CERT Coordination Center (CERT/CC) prioritizes coordination efforts on vulnerabilities.
Type string
Can be set by mapping True
Enrichment field False

vuln_cve

Description Common Vulnerabilities and Exposures identifier for the vulnerability.
Type string
Can be set by mapping True
Enrichment field False

vuln_cvss

Description CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat.
Type string
Can be set by mapping True
Enrichment field False

vuln_name

Description Name of the vulnerability.
Type string
Can be set by mapping True
Enrichment field False

vuln_reference

Description Location to find more information on the vulnerability.
Type string
Can be set by mapping True
Enrichment field False

year

Description Year pulled from the timestamp.
Type int
Can be set by mapping False
Enrichment field False