zeek

Expression

product = zeek

Fields

Field	Core	Detection	Informational
src_ip	✓
protocol		✓
connection_id			✓
dest_ip	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	src_ip	Legacy	✓	✓
	src_port	Legacy			✓
	protocol	Legacy		✓
	dest_ip	Legacy	✓	✓
	src_host	Legacy	✓	✓
	dest_port	Legacy		✓
dhcp-session	duration			✓
	transaction_id				✓
	src_mac				✓
	dhcp_type			✓
	lease_time			✓
	domain			✓
	dest_host			✓
	session_id				✓
	user_uids				✓
	domain_user_name
	user	Legacy	✓
dns-request	query_id				✓
dns-response	transaction_id				✓
	AA				✓
	TTLs				✓
	qclass_name				✓
	RD				✓
	rtt				✓
	Z				✓
	qclass				✓
	user_uid				✓
	TC				✓
	RA				✓
email-receive	rcptto	Default			✓
	cc	Default			✓
	session_id	Default			✓
	mailfrom	Default			✓
	message_id	Default			✓
	in_reply_to	Default			✓
	src_port	Default			✓
	path	Default			✓
	trans_depth	Default			✓
	reply_to	Default			✓
	event_name	Default			✓
	dest_host	Default		✓
	dest_port	Default			✓
	user_agent	Default			✓
endpoint-authentication	src_port	Default			✓
	ticket_encryption_type	Default			✓
	ticket_options	Default			✓
	request_type	Default			✓
	event_code	Default			✓
	service_name	Default			✓
	client_cert_subject	Default			✓
	result_code	Default			✓
	issue_time	Default			✓
	expiry_time	Default			✓
	dest_port	Default			✓
endpoint-login	src_port	Default			✓
	event_code	Default			✓
	process_name	Default			✓
	result_code	Default			✓
	src_host	Default		✓
	dest_port	Default			✓
file-delete	app
	mime
	local_user_name
	session_id
	src_host	Legacy		✓
	share_path			✓
	src_port			✓
	event_code			✓
	dest_host	Legacy		✓
	user	Legacy	✓	✓
	operation
	dest_port			✓
	object
file-read	timedout				✓
	mime			✓
	local_user_name
	extracted			✓
	duration				✓
	analyzers				✓
	connection_uid				✓
	event_code			✓
	hash_md5				✓
	dest_port			✓
	app
	hash_sha1				✓
	local_orig			✓
	session_id
	missed_bytes				✓
	src_host	Legacy		✓
	is_orig			✓
	share_path			✓
	extracted_cutoff			✓
	overflow_bytes			✓
	src_port			✓
	hash_sha256			✓
	depth				✓
	file_dir_id				✓
	bytes	Legacy		✓
	file_id				✓
	log_source				✓
	dest_host	Legacy		✓
	operation
	user	Legacy	✓	✓
	extracted_size			✓
	object
file-write	app
	mime
	local_user_name
	session_id
	src_host
	share_path			✓
	src_port			✓
	event_code			✓
	dest_host	Legacy		✓
	user	Legacy	✓	✓
	operation
	dest_port			✓
	object
ftp-traffic	app	Default			✓
	src_port	Default			✓
	mime	Default			✓
	local_user_name
	dest_host	Default		✓
	session_id	Default			✓
	src_host	Default		✓
	user	Default		✓
	operation	Default			✓
	dest_port	Default			✓
	object	Default			✓
http-session	orig_filenames	Default			✓
	additional_info	Default			✓
	status_msg	Default			✓
	proxied	Default			✓
	tags	Default			✓
network-session	country	Default			✓
	src_interface	Default			✓
	resp_pkts	Default			✓
	connection_age	Default			✓
	bytes_in	Default			✓
	orig_bytes	Default			✓
	service_name	Default			✓
	resp_cc	Default			✓
	local_orig	Default			✓
	orig_pkts	Default			✓
	orig_cc	Default			✓
	mbps	Default			✓
	missed_bytes	Default			✓
	history	Default			✓
	tunnel_parents	Default			✓
	connection_state	Default			✓
	duration	Default			✓
	local_resp	Default			✓
	resp_bytes	Default			✓
	bytes_out	Default			✓
	operation	Default			✓
	sensor_name	Default			✓
	user_uid	Default			✓
network-traffic	server	Default			✓
	event_code	Default			✓
	service_name	Default			✓
	cipher_method	Default			✓
radius-traffic	result	Default			✓
	response_ttl	Default			✓
	user	Default		✓
	framed_addr	Default			✓
share-access	share_type	Default			✓
	service_name	Default			✓
	native_file_system	Default			✓
ssh-traffic	cipher			✓
	kex_alg				✓
	mac_alg				✓
	server			✓
	compression_algorithm				✓
	host_key_alg			✓
	remote_location_longitude				✓
	version			✓
	remote_location_region			✓
	client_ssh_version			✓
	host_key			✓
	server_ssh_version			✓
	remote_location_city				✓
	remote_location_country_code			✓
	client			✓
	remote_location_latitude				✓
	direction			✓