Source
Fields about the source side of a network connection, used with destination.
Fields
Field Summary
| Field | Type | Level | Description |
|---|---|---|---|
source.address | keyword | Extended | Source network address. |
source.as.number | long | Extended | Unique number allocated to the autonomous system. |
source.as.organization.name | keyword | Extended | Organization name. |
source.as.organization.name.text | match_only_text | Extended | Organization name. |
source.bytes | long | Core | Bytes sent from the source to the destination. |
source.domain | keyword | Core | The domain name of the source. |
source.geo.city_name | keyword | Core | City name. |
source.geo.continent_code | keyword | Core | Continent code. |
source.geo.continent_name | keyword | Core | Name of the continent. |
source.geo.country_iso_code | keyword | Core | Country ISO code. |
source.geo.country_name | keyword | Core | Country name. |
source.geo.location | geo_point | Core | Longitude and latitude. |
source.geo.name | keyword | Extended | User-defined description of a location. |
source.geo.postal_code | keyword | Core | Postal code. |
source.geo.region_iso_code | keyword | Core | Region ISO code. |
source.geo.region_name | keyword | Core | Region name. |
source.geo.timezone | keyword | Core | Time zone. |
source.ip | ip | Core | IP address of the source. |
source.mac | keyword | Core | MAC address of the source. |
source.nat.ip | ip | Extended | Source NAT ip |
source.nat.port | long | Extended | Source NAT port |
source.packets | long | Core | Packets sent from the source to the destination. |
source.port | long | Core | Port of the source. |
source.registered_domain | keyword | Extended | The highest registered source domain, stripped of the subdomain. |
source.subdomain | keyword | Extended | The subdomain of the domain. |
source.top_level_domain | keyword | Extended | The effective top level domain (com, org, net, co.uk). |
source.user.domain | keyword | Extended | Name of the directory the user is a member of. |
source.user.email | keyword | Extended | User email address. |
source.user.full_name | keyword | Extended | User's full name, if available. |
source.user.full_name.text | match_only_text | Extended | User's full name, if available. |
source.user.group.domain | keyword | Extended | Name of the directory the group is a member of. |
source.user.group.id | keyword | Extended | Unique identifier for the group on the system/platform. |
source.user.group.name | keyword | Extended | Name of the group. |
source.user.hash | keyword | Extended | Unique user hash to correlate information for a user in anonymized form. |
source.user.id | keyword | Core | Unique identifier of the user. |
source.user.name | keyword | Core | Short name or login of the user. |
source.user.name.text | match_only_text | Core | Short name or login of the user. |
source.user.roles | keyword | Extended | Array of user roles at the time of the event. |
Field Details
source.address
Type: keyword
Level: Extended
Description: Source network address.
Indexed: true
source.as.number
Type: long
Level: Extended
Description: Unique number allocated to the autonomous system.
Example: 15169
Indexed: true
source.as.organization.name
Type: keyword
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
source.as.organization.name.text
Type: match_only_text
Level: Extended
Description: Organization name.
Example: Google LLC
Indexed: true
source.bytes
Type: long
Level: Core
Description: Bytes sent from the source to the destination.
Example: 184
Indexed: true
source.domain
Type: keyword
Level: Core
Description: The domain name of the source.
Example: foo.example.com
Indexed: true
source.geo.city_name
Type: keyword
Level: Core
Description: City name.
Example: Montreal
Indexed: true
source.geo.continent_code
Type: keyword
Level: Core
Description: Continent code.
Example: NA
Indexed: true
source.geo.continent_name
Type: keyword
Level: Core
Description: Name of the continent.
Example: North America
Indexed: true
source.geo.country_iso_code
Type: keyword
Level: Core
Description: Country ISO code.
Example: CA
Indexed: true
source.geo.country_name
Type: keyword
Level: Core
Description: Country name.
Example: Canada
Indexed: true
source.geo.location
Type: geo_point
Level: Core
Description: Longitude and latitude.
Example: { "lon": -73.614830, "lat": 45.505918 }
Indexed: true
source.geo.name
Type: keyword
Level: Extended
Description: User-defined description of a location.
Example: boston-dc
Indexed: true
source.geo.postal_code
Type: keyword
Level: Core
Description: Postal code.
Example: 94040
Indexed: true
source.geo.region_iso_code
Type: keyword
Level: Core
Description: Region ISO code.
Example: CA-QC
Indexed: true
source.geo.region_name
Type: keyword
Level: Core
Description: Region name.
Example: Quebec
Indexed: true
source.geo.timezone
Type: keyword
Level: Core
Description: Time zone.
Example: America/Argentina/Buenos_Aires
Indexed: true
source.ip
Type: ip
Level: Core
Description: IP address of the source.
Indexed: true
source.mac
Type: keyword
Level: Core
Description: MAC address of the source.
Example: 00-00-5E-00-53-23
Indexed: true
source.nat.ip
Type: ip
Level: Extended
Description: Source NAT ip
Indexed: true
source.nat.port
Type: long
Level: Extended
Description: Source NAT port
Indexed: true
source.packets
Type: long
Level: Core
Description: Packets sent from the source to the destination.
Example: 12
Indexed: true
source.port
Type: long
Level: Core
Description: Port of the source.
Indexed: true
source.registered_domain
Type: keyword
Level: Extended
Description: The highest registered source domain, stripped of the subdomain.
Example: example.com
Indexed: true
source.subdomain
Type: keyword
Level: Extended
Description: The subdomain of the domain.
Example: east
Indexed: true
source.top_level_domain
Type: keyword
Level: Extended
Description: The effective top level domain (com, org, net, co.uk).
Example: co.uk
Indexed: true
source.user.domain
Type: keyword
Level: Extended
Description: Name of the directory the user is a member of.
Indexed: true
source.user.email
Type: keyword
Level: Extended
Description: User email address.
Indexed: true
source.user.full_name
Type: keyword
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
source.user.full_name.text
Type: match_only_text
Level: Extended
Description: User's full name, if available.
Example: Albert Einstein
Indexed: true
source.user.group.domain
Type: keyword
Level: Extended
Description: Name of the directory the group is a member of.
Indexed: true
source.user.group.id
Type: keyword
Level: Extended
Description: Unique identifier for the group on the system/platform.
Indexed: true
source.user.group.name
Type: keyword
Level: Extended
Description: Name of the group.
Indexed: true
source.user.hash
Type: keyword
Level: Extended
Description: Unique user hash to correlate information for a user in anonymized form.
Indexed: true
source.user.id
Type: keyword
Level: Core
Description: Unique identifier of the user.
Example: S-1-5-21-202424912787-2692429404-2351956786-1000
Indexed: true
source.user.name
Type: keyword
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
source.user.name.text
Type: match_only_text
Level: Core
Description: Short name or login of the user.
Example: a.einstein
Indexed: true
source.user.roles
Type: keyword
Level: Extended
Description: Array of user roles at the time of the event.
Example: ["kibana_admin", "reporting_user"]
Normalization: array
Indexed: true