Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Submit an example

Action: ConnectionFailedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionRequest

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "direction": "VALUE_2",
  "established": "false",
  "ja3": "VALUE_3",
  "ja3s": "VALUE_4",
  "ja4": "VALUE_5",
  "ja4s": "VALUE_6",
  "next_protocol": "VALUE_7",
  "resumed": "false",
  "server_name": "VALUE_8",
  "ts": "1",
  "uid": "VALUE_9",
  "version": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.next_protocol`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionAttempt

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Destination Mac": "VALUE_1",
  "Packet Size": 1,
  "Source Mac": "VALUE_2",
  "Tcp Flags": 1,
  "direction": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$["Destination Mac"]`	string
`$["Packet Size"]`	integer
`$["Source Mac"]`	string
`$["Tcp Flags"]`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "direction": "VALUE_1",
  "established": "false",
  "ja3": "VALUE_2",
  "ja4": "VALUE_3",
  "resumed": "false",
  "server_name": "VALUE_4",
  "ts": "1",
  "uid": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.ja3`	string
`$.ja4`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: NetworkSignatureInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SamplePacketContent": "[\"USERNAME_1@example.invalid\"]",
  "SignatureMatchedContent": "VALUE_1",
  "SignatureName": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.SamplePacketContent`	encoded-json
`$.SamplePacketContent`	string
`$.SamplePacketContent::<json>`	array
`$.SamplePacketContent::<json>[]`	string
`$.SignatureMatchedContent`	string
`$.SignatureName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "direction": "VALUE_1",
  "qclass": "1",
  "qclass_name": "VALUE_2",
  "qtype": "1",
  "qtype_name": "VALUE_3",
  "query": "VALUE_4",
  "rcode": "1",
  "rcode_name": "VALUE_5",
  "rejected": "false",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_6"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.direction`	string
`$.qclass`	encoded-json
`$.qclass`	string
`$.qclass::<json>`	integer
`$.qclass_name`	string
`$.qtype`	encoded-json
`$.qtype`	string
`$.qtype::<json>`	integer
`$.qtype_name`	string
`$.query`	string
`$.rcode`	encoded-json
`$.rcode`	string
`$.rcode::<json>`	integer
`$.rcode_name`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionSuccessAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "direction": "VALUE_2",
  "established": "false",
  "issuer": "VALUE_3",
  "ja3": "VALUE_4",
  "ja3s": "VALUE_5",
  "ja4": "VALUE_6",
  "ja4s": "VALUE_7",
  "next_protocol": "VALUE_8",
  "resumed": "false",
  "server_name": "VALUE_9",
  "subject": "VALUE_10",
  "ts": "1",
  "uid": "VALUE_11",
  "version": "VALUE_12"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.issuer`	string
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.next_protocol`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.subject`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: HttpConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "direction": "VALUE_1",
  "host": "VALUE_2",
  "method": "VALUE_3",
  "request_body_len": "1",
  "response_body_len": "1",
  "status_code": "1",
  "status_msg": "VALUE_4",
  "tags": "[]",
  "trans_depth": "1",
  "uri": "VALUE_5",
  "user_agent": "USERNAME_1",
  "version": "1.5"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$.host`	string
`$.method`	string
`$.request_body_len`	encoded-json
`$.request_body_len`	string
`$.request_body_len::<json>`	integer
`$.response_body_len`	encoded-json
`$.response_body_len`	string
`$.response_body_len::<json>`	integer
`$.status_code`	encoded-json
`$.status_code`	string
`$.status_code::<json>`	integer
`$.status_msg`	string
`$.tags`	encoded-json
`$.tags`	string
`$.tags::<json>`	array
`$.trans_depth`	encoded-json
`$.trans_depth`	string
`$.trans_depth::<json>`	integer
`$.uri`	string
`$.user_agent`	string
`$.version`	encoded-json
`$.version`	string
`$.version::<json>`	number

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "TTLs": "[1.5]",
  "answers": "[\"VALUE_1\"]",
  "direction": "VALUE_12",
  "qclass": "1",
  "qclass_name": "VALUE_13",
  "qtype": "1",
  "qtype_name": "VALUE_14",
  "query": "VALUE_15",
  "rcode": "1",
  "rcode_name": "VALUE_16",
  "rejected": "false",
  "rtt": "1.5",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_17"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.TTLs`	encoded-json
`$.TTLs`	string
`$.TTLs::<json>`	array
`$.TTLs::<json>[]`	number
`$.answers`	encoded-json
`$.answers`	string
`$.answers::<json>`	array
`$.answers::<json>[]`	string
`$.direction`	string
`$.qclass`	encoded-json
`$.qclass`	string
`$.qclass::<json>`	integer
`$.qclass_name`	string
`$.qtype`	encoded-json
`$.qtype`	string
`$.qtype::<json>`	integer
`$.qtype_name`	string
`$.query`	string
`$.rcode`	encoded-json
`$.rcode`	string
`$.rcode::<json>`	integer
`$.rcode_name`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.rtt`	encoded-json
`$.rtt`	string
`$.rtt::<json>`	number
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "curve": "VALUE_2",
  "direction": "VALUE_3",
  "established": "false",
  "issuer": "VALUE_4",
  "ja3": "VALUE_5",
  "ja3s": "VALUE_6",
  "ja4": "VALUE_7",
  "ja4s": "VALUE_8",
  "next_protocol": "VALUE_9",
  "resumed": "false",
  "server_name": "VALUE_10",
  "subject": "VALUE_11",
  "ts": "1",
  "uid": "VALUE_12",
  "version": "VALUE_13"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.curve`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.issuer`	string
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.next_protocol`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.subject`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "client_issuer": "VALUE_2",
  "client_subject": "VALUE_3",
  "curve": "VALUE_4",
  "direction": "VALUE_5",
  "established": "false",
  "issuer": "VALUE_6",
  "ja3": "VALUE_7",
  "ja3s": "VALUE_8",
  "ja4": "VALUE_9",
  "ja4s": "VALUE_10",
  "resumed": "false",
  "server_name": "VALUE_11",
  "subject": "VALUE_12",
  "ts": "1",
  "uid": "VALUE_13",
  "version": "VALUE_14"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.client_issuer`	string
`$.client_subject`	string
`$.curve`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.issuer`	string
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.subject`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "direction": "VALUE_1",
  "qclass": "1",
  "qclass_name": "VALUE_2",
  "qtype": "1",
  "qtype_name": "VALUE_3",
  "query": "VALUE_4",
  "rejected": "false",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.direction`	string
`$.qclass`	encoded-json
`$.qclass`	string
`$.qclass::<json>`	integer
`$.qclass_name`	string
`$.qtype`	encoded-json
`$.qtype`	string
`$.qtype::<json>`	integer
`$.qtype_name`	string
`$.query`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionAcknowledged

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Destination Mac": "VALUE_1",
  "Packet Size": 1,
  "Source Mac": "VALUE_2",
  "Tcp Flags": 1,
  "direction": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$["Destination Mac"]`	string
`$["Packet Size"]`	integer
`$["Source Mac"]`	string
`$["Tcp Flags"]`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "curve": "VALUE_2",
  "direction": "VALUE_3",
  "established": "false",
  "issuer": "VALUE_4",
  "ja3": "VALUE_5",
  "ja3s": "VALUE_6",
  "ja4": "VALUE_7",
  "ja4s": "VALUE_8",
  "resumed": "false",
  "server_name": "VALUE_9",
  "subject": "VALUE_10",
  "ts": "1",
  "uid": "VALUE_11",
  "version": "VALUE_12"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.curve`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.issuer`	string
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.subject`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "direction": "VALUE_1",
  "rcode": "1",
  "rcode_name": "VALUE_2",
  "rejected": "false",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.direction`	string
`$.rcode`	encoded-json
`$.rcode`	string
`$.rcode::<json>`	integer
`$.rcode_name`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "TTLs": "[1.5]",
  "answers": "[\"VALUE_1\"]",
  "direction": "VALUE_3",
  "query": "VALUE_4",
  "rcode": "1",
  "rcode_name": "VALUE_5",
  "rejected": "false",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_6"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.TTLs`	encoded-json
`$.TTLs`	string
`$.TTLs::<json>`	array
`$.TTLs::<json>[]`	number
`$.answers`	encoded-json
`$.answers`	string
`$.answers::<json>`	array
`$.answers::<json>[]`	string
`$.direction`	string
`$.query`	string
`$.rcode`	encoded-json
`$.rcode`	string
`$.rcode::<json>`	integer
`$.rcode_name`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: HttpConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "direction": "VALUE_1",
  "host": "VALUE_2",
  "method": "VALUE_3",
  "request_body_len": "1",
  "response_body_len": "1",
  "tags": "[]",
  "trans_depth": "1",
  "uri": "VALUE_4",
  "user_agent": "USERNAME_1"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$.host`	string
`$.method`	string
`$.request_body_len`	encoded-json
`$.request_body_len`	string
`$.request_body_len::<json>`	integer
`$.response_body_len`	encoded-json
`$.response_body_len`	string
`$.response_body_len::<json>`	integer
`$.tags`	encoded-json
`$.tags`	string
`$.tags::<json>`	array
`$.trans_depth`	encoded-json
`$.trans_depth`	string
`$.trans_depth::<json>`	integer
`$.uri`	string
`$.user_agent`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: IcmpConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "conn_state": "VALUE_1",
  "direction": "VALUE_2",
  "duration": "1.5",
  "missed_bytes": "1",
  "orig_bytes": "1",
  "orig_ip_bytes": "1",
  "orig_pkts": "1",
  "resp_bytes": "1",
  "resp_ip_bytes": "1",
  "resp_pkts": "1",
  "uid": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.conn_state`	string
`$.direction`	string
`$.duration`	encoded-json
`$.duration`	string
`$.duration::<json>`	number
`$.missed_bytes`	encoded-json
`$.missed_bytes`	string
`$.missed_bytes::<json>`	integer
`$.orig_bytes`	encoded-json
`$.orig_bytes`	string
`$.orig_bytes::<json>`	integer
`$.orig_ip_bytes`	encoded-json
`$.orig_ip_bytes`	string
`$.orig_ip_bytes::<json>`	integer
`$.orig_pkts`	encoded-json
`$.orig_pkts`	string
`$.orig_pkts::<json>`	integer
`$.resp_bytes`	encoded-json
`$.resp_bytes`	string
`$.resp_bytes::<json>`	integer
`$.resp_ip_bytes`	encoded-json
`$.resp_ip_bytes`	string
`$.resp_ip_bytes::<json>`	integer
`$.resp_pkts`	encoded-json
`$.resp_pkts`	string
`$.resp_pkts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionRequest

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionRequest

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionRequest

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: InboundInternetScanInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "PublicScannedIp": "192.0.2.1",
  "PublicScannedPort": 1
}

Payload fields and types

Path	Type
`$`	object
`$.PublicScannedIp`	string
`$.PublicScannedPort`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ConnectionSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: HttpConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "direction": "VALUE_1",
  "request_body_len": "1",
  "response_body_len": "1",
  "status_code": "1",
  "status_msg": "VALUE_2",
  "tags": "[]",
  "trans_depth": "1",
  "version": "1.5"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$.request_body_len`	encoded-json
`$.request_body_len`	string
`$.request_body_len::<json>`	integer
`$.response_body_len`	encoded-json
`$.response_body_len`	string
`$.response_body_len::<json>`	integer
`$.status_code`	encoded-json
`$.status_code`	string
`$.status_code::<json>`	integer
`$.status_msg`	string
`$.tags`	encoded-json
`$.tags`	string
`$.tags::<json>`	array
`$.trans_depth`	encoded-json
`$.trans_depth`	string
`$.trans_depth::<json>`	integer
`$.version`	encoded-json
`$.version`	string
`$.version::<json>`	number

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AA": "false",
  "RA": "false",
  "RD": "false",
  "TC": "false",
  "TTLs": "[1.5]",
  "answers": "[\"VALUE_1\"]",
  "direction": "VALUE_2",
  "qclass": "1",
  "qclass_name": "VALUE_3",
  "qtype": "1",
  "qtype_name": "VALUE_4",
  "query": "VALUE_5",
  "rcode": "1",
  "rcode_name": "VALUE_6",
  "rejected": "false",
  "trans_id": "1",
  "ts": "1",
  "uid": "VALUE_7"
}

Payload fields and types

Path	Type
`$`	object
`$.AA`	encoded-json
`$.AA`	string
`$.AA::<json>`	boolean
`$.RA`	encoded-json
`$.RA`	string
`$.RA::<json>`	boolean
`$.RD`	encoded-json
`$.RD`	string
`$.RD::<json>`	boolean
`$.TC`	encoded-json
`$.TC`	string
`$.TC::<json>`	boolean
`$.TTLs`	encoded-json
`$.TTLs`	string
`$.TTLs::<json>`	array
`$.TTLs::<json>[]`	number
`$.answers`	encoded-json
`$.answers`	string
`$.answers::<json>`	array
`$.answers::<json>[]`	string
`$.direction`	string
`$.qclass`	encoded-json
`$.qclass`	string
`$.qclass::<json>`	integer
`$.qclass_name`	string
`$.qtype`	encoded-json
`$.qtype`	string
`$.qtype::<json>`	integer
`$.qtype_name`	string
`$.query`	string
`$.rcode`	encoded-json
`$.rcode`	string
`$.rcode::<json>`	integer
`$.rcode_name`	string
`$.rejected`	encoded-json
`$.rejected`	string
`$.rejected::<json>`	boolean
`$.trans_id`	encoded-json
`$.trans_id`	string
`$.trans_id::<json>`	integer
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: HttpConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "direction": "VALUE_1",
  "host": "VALUE_2",
  "method": "VALUE_3",
  "request_body_len": "1",
  "resp_filenames": "[\"SAMPLEFILE_1.txt\"]",
  "response_body_len": "1",
  "status_code": "1",
  "status_msg": "VALUE_4",
  "tags": "[]",
  "trans_depth": "1",
  "uri": "VALUE_5",
  "user_agent": "USERNAME_1",
  "version": "1.5"
}

Payload fields and types

Path	Type
`$`	object
`$.direction`	string
`$.host`	string
`$.method`	string
`$.request_body_len`	encoded-json
`$.request_body_len`	string
`$.request_body_len::<json>`	integer
`$.resp_filenames`	encoded-json
`$.resp_filenames`	string
`$.resp_filenames::<json>`	array
`$.resp_filenames::<json>[]`	string
`$.response_body_len`	encoded-json
`$.response_body_len`	string
`$.response_body_len::<json>`	integer
`$.status_code`	encoded-json
`$.status_code`	string
`$.status_code::<json>`	integer
`$.status_msg`	string
`$.tags`	encoded-json
`$.tags`	string
`$.tags::<json>`	array
`$.trans_depth`	encoded-json
`$.trans_depth`	string
`$.trans_depth::<json>`	integer
`$.uri`	string
`$.user_agent`	string
`$.version`	encoded-json
`$.version`	string
`$.version::<json>`	number

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: SslConnectionInspected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "cipher": "VALUE_1",
  "curve": "VALUE_2",
  "direction": "VALUE_3",
  "established": "false",
  "ja3": "VALUE_4",
  "ja3s": "VALUE_5",
  "ja4": "VALUE_6",
  "ja4s": "VALUE_7",
  "resumed": "false",
  "server_name": "VALUE_8",
  "ts": "1",
  "uid": "VALUE_9",
  "version": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.cipher`	string
`$.curve`	string
`$.direction`	string
`$.established`	encoded-json
`$.established`	string
`$.established::<json>`	boolean
`$.ja3`	string
`$.ja3s`	string
`$.ja4`	string
`$.ja4s`	string
`$.resumed`	encoded-json
`$.resumed`	string
`$.resumed::<json>`	boolean
`$.server_name`	string
`$.ts`	encoded-json
`$.ts`	string
`$.ts::<json>`	integer
`$.uid`	string
`$.version`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

DeviceNetworkEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Network connection and related events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LocalIP	IP address assigned to the local machine used during communication	String
LocalIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
LocalPort	TCP port on the local machine used during communication	Int32
MachineGroup		String
Protocol	Protocol used during the communication	String
RemoteIP	IP address that was being connected to	String
RemoteIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
RemotePort	TCP port on the remote device that was being connected to	Int32
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
ConnectionAcknowledged	An acknowledgement that a TCP connection was accepted (syn/ack) was made.
ConnectionAttempt	An attempt to establish a TCP connection (syn) was made.
ConnectionFailed	An attempt to establish a network connection from the device failed.
ConnectionFound	An active network connection was found on the device.
ConnectionRequest	The device initiated a network connection.
ConnectionSuccess	A network connection was successfully established from the device.
DnsConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected a DNS connection.
FtpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an FTP connection.
HttpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an HTTP connection.
IcmpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an ICMP connection.
InboundConnectionAccepted	The device accepted a network connection initiated by another device.
InboundInternetScanInspected	An incoming packet from a Microsoft Defender External Attack Surface Management scan was inspected on the device.
ListeningConnectionCreated	A process has started listening for connections on a certain port.
NetworkSignatureInspected	A packet content was inspected.
NtlmAuthenticationInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected a connection with NTLM authentication.
SmtpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SMTP connection.
SshConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSH connection.
SslConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSL connection.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: RemoteUrl, InitiatingProcessFileName, InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoProductName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessVersionInfoFileDescription, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessParentFileName, InitiatingProcessAccountUpn, AdditionalFields.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.

DeviceNetworkEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Network connection and related events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LocalIP	IP address assigned to the local machine used during communication	String
LocalIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
LocalPort	TCP port on the local machine used during communication	Int32
MachineGroup		String
Protocol	Protocol used during the communication	String
RemoteIP	IP address that was being connected to	String
RemoteIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
RemotePort	TCP port on the remote device that was being connected to	Int32
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
ConnectionAcknowledged	An acknowledgement that a TCP connection was accepted (syn/ack) was made.
ConnectionAttempt	An attempt to establish a TCP connection (syn) was made.
ConnectionFailed	An attempt to establish a network connection from the device failed.
ConnectionFound	An active network connection was found on the device.
ConnectionRequest	The device initiated a network connection.
ConnectionSuccess	A network connection was successfully established from the device.
DnsConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected a DNS connection.
FtpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an FTP connection.
HttpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an HTTP connection.
IcmpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an ICMP connection.
InboundConnectionAccepted	The device accepted a network connection initiated by another device.
InboundInternetScanInspected	An incoming packet from a Microsoft Defender External Attack Surface Management scan was inspected on the device.
ListeningConnectionCreated	A process has started listening for connections on a certain port.
NetworkSignatureInspected	A packet content was inspected.
NtlmAuthenticationInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected a connection with NTLM authentication.
SmtpConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SMTP connection.
SshConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSH connection.
SslConnectionInspected	The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSL connection.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

Known observations

Value casing varies

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.