Destination
Fields about the destination side of a network connection, used with source.
Fields
Field Summary
| Field | Type | Level | Description |
|---|---|---|---|
destination.address | keyword | Extended | Destination network address. |
destination.as.number | long | Extended | Unique number allocated to the autonomous system. |
destination.as.organization.name | keyword | Extended | Organization name. |
destination.as.organization.name.text | match_only_text | Extended | Organization name. |
destination.bytes | long | Core | Bytes sent from the destination to the source. |
destination.domain | keyword | Core | Destination domain. |
destination.geo.city_name | keyword | Core | City name. |
destination.geo.continent_code | keyword | Core | Continent code. |
destination.geo.continent_name | keyword | Core | Name of the continent. |
destination.geo.country_iso_code | keyword | Core | Country ISO code. |
destination.geo.country_name | keyword | Core | Country name. |
destination.geo.location | geo_point | Core | Longitude and latitude. |
destination.geo.name | keyword | Extended | User-defined description of a location. |
destination.geo.postal_code | keyword | Core | Postal code. |
destination.geo.region_iso_code | keyword | Core | Region ISO code. |
destination.geo.region_name | keyword | Core | Region name. |
destination.geo.timezone | keyword | Core | Time zone. |
destination.ip | ip | Core | IP address of the destination. |
destination.mac | keyword | Core | MAC address of the destination. |
destination.nat.ip | ip | Extended | Destination NAT ip |
destination.nat.port | long | Extended | Destination NAT Port |
destination.packets | long | Core | Packets sent from the destination to the source. |
destination.port | long | Core | Port of the destination. |
destination.registered_domain | keyword | Extended | The highest registered destination domain, stripped of the subdomain. |
destination.subdomain | keyword | Extended | The subdomain of the domain. |
destination.top_level_domain | keyword | Extended | The effective top level domain (com, org, net, co.uk). |
destination.user.domain | keyword | Extended | Name of the directory the user is a member of. |
destination.user.email | keyword | Extended | User email address. |
destination.user.full_name | keyword | Extended | User's full name, if available. |
destination.user.full_name.text | match_only_text | Extended | User's full name, if available. |
destination.user.group.domain | keyword | Extended | Name of the directory the group is a member of. |
destination.user.group.id | keyword | Extended | Unique identifier for the group on the system/platform. |
destination.user.group.name | keyword | Extended | Name of the group. |
destination.user.hash | keyword | Extended | Unique user hash to correlate information for a user in anonymized form. |
destination.user.id | keyword | Core | Unique identifier of the user. |
destination.user.name | keyword | Core | Short name or login of the user. |
destination.user.name.text | match_only_text | Core | Short name or login of the user. |
destination.user.roles | keyword | Extended | Array of user roles at the time of the event. |
Field Details
destination.address
Type: keyword
Level: Extended
Description: Destination network address.
Indexed: true
destination.as.number
Type: long
Level: Extended
Description: Unique number allocated to the autonomous system.
Example: 15169
Indexed: true
destination.as.organization.name
Type: keyword
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
destination.as.organization.name.text
Type: match_only_text
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
destination.bytes
Type: long
Level: Core
Description: Bytes sent from the destination to the source.
Example: 184
Indexed: true
destination.domain
Type: keyword
Level: Core
Description: Destination domain.
Indexed: true
destination.geo.city_name
Type: keyword
Level: Core
Description: City name.
Example: Montreal
Indexed: true
destination.geo.continent_code
Type: keyword
Level: Core
Description: Continent code.
Example: NA
Indexed: true
destination.geo.continent_name
Type: keyword
Level: Core
Description: Name of the continent.
Example: North America
Indexed: true
destination.geo.country_iso_code
Type: keyword
Level: Core
Description: Country ISO code.
Example: CA
Indexed: true
destination.geo.country_name
Type: keyword
Level: Core
Description: Country name.
Example: Canada
Indexed: true
destination.geo.location
Type: geo_point
Level: Core
Description: Longitude and latitude.
Example: { "lon": -73.614830, "lat": 45.505918 }
Indexed: true
destination.geo.name
Type: keyword
Level: Extended
Description: User-defined description of a location.
Example: boston-dc
Indexed: true
destination.geo.postal_code
Type: keyword
Level: Core
Description: Postal code.
Example: 94040
Indexed: true
destination.geo.region_iso_code
Type: keyword
Level: Core
Description: Region ISO code.
Example: CA-QC
Indexed: true
destination.geo.region_name
Type: keyword
Level: Core
Description: Region name.
Example: Quebec
Indexed: true
destination.geo.timezone
Type: keyword
Level: Core
Description: Time zone.
Example: America/Argentina/Buenos_Aires
Indexed: true
destination.ip
Type: ip
Level: Core
Description: IP address of the destination.
Indexed: true
destination.mac
Type: keyword
Level: Core
Description: MAC address of the destination.
Example: 00-00-5E-00-53-23
Indexed: true
destination.nat.ip
Type: ip
Level: Extended
Description: Destination NAT ip
Indexed: true
destination.nat.port
Type: long
Level: Extended
Description: Destination NAT Port
Indexed: true
destination.packets
Type: long
Level: Core
Description: Packets sent from the destination to the source.
Example: 12
Indexed: true
destination.port
Type: long
Level: Core
Description: Port of the destination.
Indexed: true
destination.registered_domain
Type: keyword
Level: Extended
Description: The highest registered destination domain, stripped of the subdomain.
Example: example.com
Indexed: true
destination.subdomain
Type: keyword
Level: Extended
Description: The subdomain of the domain.
Example: east
Indexed: true
destination.top_level_domain
Type: keyword
Level: Extended
Description: The effective top level domain (com, org, net, co.uk).
Example: co.uk
Indexed: true
destination.user.domain
Type: keyword
Level: Extended
Description: Name of the directory the user is a member of.
Indexed: true
destination.user.email
Type: keyword
Level: Extended
Description: User email address.
Indexed: true
destination.user.full_name
Type: keyword
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
destination.user.full_name.text
Type: match_only_text
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
destination.user.group.domain
Type: keyword
Level: Extended
Description: Name of the directory the group is a member of.
Indexed: true
destination.user.group.id
Type: keyword
Level: Extended
Description: Unique identifier for the group on the system/platform.
Indexed: true
destination.user.group.name
Type: keyword
Level: Extended
Description: Name of the group.
Indexed: true
destination.user.hash
Type: keyword
Level: Extended
Description: Unique user hash to correlate information for a user in anonymized form.
Indexed: true
destination.user.id
Type: keyword
Level: Core
Description: Unique identifier of the user.
Example: S-1-5-21-202424912787-2692429404-2351956786-1000
Indexed: true
destination.user.name
Type: keyword
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
destination.user.name.text
Type: match_only_text
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
destination.user.roles
Type: keyword
Level: Extended
Description: Array of user roles at the time of the event.
Example: ["kibana_admin", "reporting_user"]
Normalization: array
Indexed: true