source¶
Event fields used to define the source (client) in a network connection event.
Attributes¶
Name |
Type |
Description |
Sample Value |
|---|---|---|---|
src_bytes |
integer |
network bytes sent by the src_ip_addr |
|
src_city |
string |
The city associated with the source IP address |
|
src_country |
country |
The country associated with the source IP address |
|
src_domain |
string |
The (DNS) hierarchy that encompasses multiple hosts (i.e a Windows Active Directory environment). |
|
src_file_accessed_time |
date |
When the file was last accessed . Also known as |
|
src_file_changed_time |
date |
When the file was last changed. Also known as |
|
src_file_creation_time |
date |
When the file was created. Also known as |
|
src_file_directory |
string |
Directory of file(s). It does not include the file name |
|
src_file_extension |
string |
The file extension of a file (.txt, .exe, etc) |
|
src_file_hard_links |
integer |
Number of hard links |
|
src_file_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_file_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_file_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_file_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_file_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_file_inode |
integer |
Filesystem inode number |
`````` |
src_file_link_name |
string |
path of the hard link |
|
src_file_mime_type |
string |
Specifies the MIME type name specified for a file |
|
src_file_modified_time |
date |
When the file was last modified. Also known as |
|
src_file_name |
string |
name of a file without its full path. This could be a local file or transmitted over the network. |
|
src_file_path |
string |
full path of a file including the name of the file. |
|
src_file_previous_name |
string |
The file’s previous name |
|
src_file_size |
string |
Specifies the size of a file, in bytes |
|
src_file_symlink |
integer |
1 if the path is a symlink, otherwise 0 |
|
src_file_symlink_name |
string |
path of the symlink |
|
src_file_system_block_size |
integer |
Block size of filesystem |
`````` |
src_file_system_type |
string |
The file system type, ex: fat32, ntfs, vmfs, ext3, ext4, xfs |
|
src_fqdn |
string |
The absolute (entire) value of the DNS hierarchy from the lowest level to the top level domain (TLD). Consists of the Hostname and Domain. This is best defined in this Wikipedia article on FQDN. |
|
src_host_domain |
string |
Name of the domain the host is part of or joined. |
|
src_host_fqdn |
string |
The fully qualified domain name of the host |
|
src_host_interface_guid |
string |
GUID of the network interface which was used for authentication request |
|
src_host_interface_name |
string |
the name (description) of the network interface that was used for authentication request. You can get the list of all available network adapters using “ipconfig /all” command |
|
src_host_local_mac |
string |
local interface’s MAC-address |
|
src_host_model |
string |
The model of the source device |
|
src_host_name |
string |
The name of a host, device, node, or entity that is separate from the FQDN and Domain. |
|
src_host_os |
string |
The OS of the source device |
|
src_host_peer_mac |
string |
peer’s (typically - access point) MAC-address |
|
src_host_type |
string |
The type of the source device |
|
src_interface_guid |
string |
GUID of the network interface which was used for authentication request. |
|
src_interface_name |
string |
The network interface used for the connection or session by the source device. |
|
src_ip_addr |
ip |
IP address captured in a network connection. This could be used in the context of source, destination and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
src_ip_bytes |
integer |
network IP (header) bytes sent by the either the source or destination ip address |
|
src_ip_dhcp_assigned_ip_addr |
ip |
IP address assigned by the DHCP server. |
|
src_ip_is_ipv6 |
boolean |
If source or destination IP address is IP version 6 |
|
src_latitude |
real |
The latitude of the geographical coordinate associated with the source IP address |
|
src_longitude |
real |
The longitude of the geographical coordinate associated with the source IP address |
|
src_mac_address |
mac |
MAC address of an endpoint or network interface where a connection starts or ends. |
|
src_mime_type |
string |
Source MIME type as seen in (layer 7) application layer details or as defined by an application scanner such as an anti-virus/EDR. For HTTP this is usually from the server’s “Content-Type” header. https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Complete_list_of_MIME_types |
|
src_packets |
integer |
Network packets sent by the source |
|
src_port_name |
string |
Name of the port used in a network connection. This is usually determined by IANA common port assignment. Therefore, this means its a guess and NOT actually what the application/ is what the actually. |
|
src_port_number |
integer |
Port number used in a network connection. This could be used in the context of source, destination and even NAT when it is provided by an intermediary NAT device such as a firewall. |
|
src_process_call_trace |
string |
Stack trace of where open process is called |
|
src_process_command_line |
string |
Command arguments that were were executed by the process in the endpoint. |
|
src_process_company |
string |
Company name metadata of the Image file |
|
src_process_file_description |
string |
Description of the Image file |
|
src_process_file_directory |
string |
Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path. |
|
src_process_file_name |
string |
Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_file_path |
string |
The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. |
|
src_process_file_product |
string |
The Image’s file product name |
|
src_process_file_version |
string |
Version of the Image file |
|
src_process_granted_access |
string |
granted access code requested/used to open a target process |
|
src_process_guid |
string |
Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command. |
|
src_process_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_process_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_process_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_process_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_process_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_process_id |
integer |
Process unique identifier used by the current operating system to identify a process. |
|
src_process_injected_address |
string |
The memory address where the subprocess is injected |
|
src_process_integrity_level |
string |
Integrity label assigned to a process |
|
src_process_is_hidden |
boolean |
Describes if the process is hidden. |
|
src_process_name |
string |
Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_parent_call_trace |
string |
Stack trace of where open process is called |
|
src_process_parent_command_line |
string |
Command arguments that were were executed by the process in the endpoint. |
|
src_process_parent_company |
string |
Company name metadata of the Image file |
|
src_process_parent_file_description |
string |
Description of the Image file |
|
src_process_parent_file_directory |
string |
Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path. |
|
src_process_parent_file_name |
string |
Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_process_parent_file_path |
string |
The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. |
|
src_process_parent_file_product |
string |
The Image’s file product name |
|
src_process_parent_file_version |
string |
Version of the Image file |
|
src_process_parent_granted_access |
string |
granted access code requested/used to open a target process |
|
src_process_parent_guid |
string |
Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command. |
|
src_process_parent_hash_imphash |
string |
IMPHASH hash of the image/binary/file |
|
src_process_parent_hash_md5 |
string |
MD5 hash of the image/binary/file |
|
src_process_parent_hash_sha1 |
string |
SHA1 hash of the image/binary/file |
|
src_process_parent_hash_sha256 |
string |
SHA256 hash of the image/binary/file |
|
src_process_parent_hash_sha512 |
string |
SHA512 hash of the image/binary/file |
|
src_process_parent_id |
integer |
Process unique identifier used by the current operating system to identify a process. |
|
src_process_parent_injected_address |
string |
The memory address where the subprocess is injected |
|
src_process_parent_integrity_level |
string |
Integrity label assigned to a process |
|
src_process_parent_is_hidden |
boolean |
Describes if the process is hidden. |
|
src_process_parent_name |
string |
Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file. |
|
src_region |
string |
The region within a country associated with the source IP address |
|
src_resource_group |
string |
The ID of the group to which the source device belongs in a network connection. This might be an AWS account, or an Azure subscription or Resource Group |
|
src_resource_id |
string |
The resource Id of the source device in a network connection |
|
src_user_cred_type |
string |
types of credentials which were presented for delegation |
|
src_user_dentity |
string |
User Principal Name (UPN) or another type of account identifier for which 802.1x authentication request was made. |
|
src_user_domain |
string |
subject’s domain or computer name of the account that performed the main action in the event |
|
src_user_linked_logon_id |
integer |
A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “0x0”. |
|
src_user_logon_authentication_lan_package_name |
string |
The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon. Possible values are: NTLM V1, NTLM V2, LM. Only populated if Authentication Package = NTLM. |
|
src_user_logon_authentication_lan_package_name |
string |
The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon. Possible values are: NTLM V1, NTLM V2, LM. Only populated if Authentication Package = NTLM. |
|
src_user_logon_authentication_package_name |
string |
The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “4610: An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “4622: A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. |
|
src_user_logon_authentication_package_name |
string |
The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “4610: An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “4622: A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. |
|
src_user_logon_device_claims |
string |
list of device claims for new logon session |
|
src_user_logon_device_claims |
string |
list of device claims for new logon session |
|
src_user_logon_elevated_token |
string |
a “Yes” or “No” flag. If “Yes” then the session this event represents is elevated and has administrator privileges. |
|
src_user_logon_elevated_token |
string |
a “Yes” or “No” flag. If “Yes” then the session this event represents is elevated and has administrator privileges. |
|
src_user_logon_guid |
string |
a GUID that can help you correlate this event with another event that can contain the same Logon GUID, “4769(S, F): A Kerberos service ticket was requested event on a domain controller. It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same Logon GUID, “4648(S): A logon was attempted using explicit credentials” and “4964(S): Special groups have been assigned to a new logon.” |
|
src_user_logon_guid |
string |
a GUID that can help you correlate this event with another event that can contain the same Logon GUID, “4769(S, F): A Kerberos service ticket was requested event on a domain controller. It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same Logon GUID, “4648(S): A logon was attempted using explicit credentials” and “4964(S): Special groups have been assigned to a new logon.” |
|
src_user_logon_id |
integer |
hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID |
|
src_user_logon_id |
integer |
hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID |
|
src_user_logon_impersonation_level |
string |
Impersonation level |
|
src_user_logon_impersonation_level |
string |
Impersonation level |
|
src_user_logon_key_length |
integer |
the length of NTLM Session Security key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “Authentication Package” = “Kerberos”, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using Negotiate authentication package. |
|
src_user_logon_key_length |
integer |
the length of NTLM Session Security key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “Authentication Package” = “Kerberos”, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using Negotiate authentication package. |
|
src_user_logon_process_name |
string |
The name of the trusted logon process that was used for the logon. See event “4611: A trusted logon process has been registered with the Local Security Authority” description for more information. |
|
src_user_logon_process_name |
string |
The name of the trusted logon process that was used for the logon. See event “4611: A trusted logon process has been registered with the Local Security Authority” description for more information. |
|
src_user_logon_restricted_admin_mode |
string |
Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. If not a RemoteInteractive logon, then this will be “-” string. |
|
src_user_logon_restricted_admin_mode |
string |
Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. If not a RemoteInteractive logon, then this will be “-” string. |
|
src_user_logon_transmitted_services |
string |
the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user - most commonly done by a front-end website to access an internal resource on behalf of a user. |
|
src_user_logon_transmitted_services |
string |
the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user - most commonly done by a front-end website to access an internal resource on behalf of a user. |
|
src_user_logon_type |
integer |
the type of logon which was performed |
|
src_user_logon_type |
integer |
the type of logon which was performed |
|
src_user_logon_user_claims |
string |
list of user claims for new logon session. This field contains user claims if user account was logged in and device claims if computer account was logged in |
|
src_user_logon_user_claims |
string |
list of user claims for new logon session. This field contains user claims if user account was logged in and device claims if computer account was logged in |
|
src_user_logon_user_linked_id |
integer |
A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “0x0”. |
|
src_user_logon_user_linked_id |
integer |
A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “0x0”. |
|
src_user_logon_virtual_account |
string |
a “Yes” or “No” flag, which indicates if the account is a virtual account (e.g., “Managed Service Account”), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using “NetworkService”. |
|
src_user_logon_virtual_account |
string |
a “Yes” or “No” flag, which indicates if the account is a virtual account (e.g., “Managed Service Account”), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using “NetworkService”. |
|
src_user_name |
string |
Name of the account that performed the main action in the event. (i.e. user_name authenticated to the box x or user_name spawned a process) |
|
src_user_network_account_domain |
string |
Domain for the user that will be used for outbound (network) connections. Valid only for NewCredentials logon type. If not NewCredentials logon, then this will be a “-” string. |
|
src_user_network_account_name |
string |
User name that will be used for outbound (network) connections. Valid only for NewCredentials logon type. If not NewCredentials logon, then this will be a “-” string. |
|
src_user_password |
string |
User password if seen in the request. Commonly seen in network logs and authentication proxy/logs. |
|
src_user_reporter_domain |
string |
subject’s domain or computer name of the account that reported information about the main event |
|
src_user_reporter_id |
integer |
hexadecimal value that can help you correlate an event with recent events that might contain the same Logon ID for the account that reported information about the main event |
|
src_user_reporter_name |
string |
the name of the account that reported information about the main event |
|
src_user_reporter_sid |
string |
SID of account that reported information about the main event |
|
src_user_security_package |
string |
the name of Security Package which was used by the account that performed the main action in the event. Always CREDSSP for this event. |
|
src_user_session_id |
integer |
ID of the session the account tha performed the main action in the event belongs to |
|
src_user_sid |
string |
Security identifier of the account that performed the main action in the event |
|
src_user_sid_list |
string |
the list of special group SIDs, which New Logon\Security ID is a member of. |
|
src_user_upn |
string |
UPN of the account for which delegation was requested. |
|
src_user_user_aadid |
string |
The User Azure AD ID of the identity associated with a cloud network session. It applies to source and destination entities. |
|
src_vlan_id |
integer |
The Source VLAN ID if it can be determined. Most commonly if from a firewall/switch/router then it can be determined |
|
src_vlan_name |
string |
The Source VLAN Name. Most commonly if from a firewall/switch/router then it can be determined |
|
src_zone |
string |
The network zone of the source, as defined by the reporting device. |
|