hunters-forge-OSSEM/docs/cdm/entities/device.md

device

Events used to normalize events for the device or endpoint that generated the event (source or destination).

Attributes

Name	Type	Description	Sample Value
dvc_action	string	If reported by an intermediary device such as a firewall, the action taken by device.	allow
dvc_domain	string	Name of the domain the device is part of.	hunt.wardog.com
dvc_fqdn	string	The fully qualified domain name of the host	WKHR001.hunt.wardog.com
dvc_hostname	string	The host name from which the event/log came from. There may be multiple host names in an event (i.e. syslog could have forwarder host name), this field is to be the most true log host name (i.e. NOT the forwarders name).	bobs.uncle-pc
dvc_inbound_interface	string	If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the source device	eth0
dvc_interface_guid	string	GUID of the network interface which was used for authentication request	{2BB33827-6BB6-48DB-8DE6-DB9E0B9F9C9B}
dvc_interface_name	string	the name (description) of the network interface that was used for authentication request. You can get the list of all available network adapters using "ipconfig /all" command	Microsoft Hyper-V Network Adapter
dvc_ip_addr	ip	IP address assigned to the device generating the event and/or the IP address in the network packet. This could be used in the context of source, destination, device and even NAT when it is provided by an intermediary NAT device such as a firewall.	192.168.1.2
dvc_ip_dhcp_assigned_ip_addr	ip	IP address assigned by the DHCP server.	192.168.1.2
dvc_ip_is_ipv6	boolean	If IP address is IP version 6	false
dvc_mac_addr	string	MAC address of the device where the event was generated or network interface where a connection starts or ends.	00:11:22:33:44:55
dvc_model_name	string	The model name of the device	Samsung Galaxy Note
dvc_model_number	string	The model number of the device	10
dvc_os	string	The OS of the device	iOS
dvc_outbound_interface	string	If reported by an intermediary device such as a firewall, the network interface used by it for the connection to the destination device.	Ethernet 4
dvc_type	string	The type of the device	mobile