any¶
Fields used to define metadata for a single field to include data from multiple fields with similar/same values/data. This data is most commonly created from an ETL pipeline. Any fields below that contain a ‘*’ indicates those are searches and not actual fields (key/values). This is because certain values are not desirable to copy/duplicate. However, because of a common schema we can still find are values for a specific common type, without duplicating or copying everything to one field!
Attributes¶
Name |
Type |
Description |
Sample Value |
|---|---|---|---|
any_event_uid |
string |
Allows searching a single field for all log IDs. All log ID fields copied/duplicated to a single field as an array. |
```````` |
any_hash |
string |
Allows searching a single field for all hashes. All hash fields copied/duplicated to a single field as an array. |
```````` |
any_ip_addr |
ip |
Allows searching a single field for all IPs. All IP fields copied/duplicated to a single field as an array. |
```````` |
any_ip_addr |
ip |
IP address captures in a network connection. This could be used in the context of source, destination and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
any_ip_bytes |
integer |
network IP (header) bytes sent by the either the source or destination ip address |
|
any_ip_dhcp_assigned_ip_addr |
ip |
IP address assigned by the DHCP server. |
|
any_ip_geo.as_org |
string |
Allows searching a single field for all BGP AS Organization Names. All AS name fields copied/duplicated to a single field as an array. |
```````` |
any_ip_geo.asn |
integer |
Allows searching a single field for all BGP AS Numbers. All AS number fields copied/duplicated to a single field as an array. |
```````` |
any_ip_is_ipv6 |
boolean |
If source or destination IP address is IP version 6 |
|
any_mac_addr |
string |
Allows searching a single field for all MAC addresses. All MAC address fields copied/duplicated to a single field as an array. |
```````` |
any_user |
string |
Allows searching a single field for all users. All user fields copied/duplicated to a single field as an array. |
```````` |
any_vlan_id |
integer |
Allows searching a single field for all VLAN IDs. All VLAN ID fields copied/duplicated to a single field as an array. |
`````` |