{"documents":15774077,"indices":[{"dataset":"elastic_agent","index":"logs-elastic_agent-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"NumCPU":{"type":"long"},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"Version":{"ignore_above":8191,"type":"keyword"},"address":{"ignore_above":8191,"type":"keyword"},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"}}},"type":{"ignore_above":1024,"type":"keyword"},"unprivileged":{"type":"boolean"},"upgrade":{"properties":{"watcher":{"properties":{"process":{"properties":{"pid":{"type":"long"}}}}}}},"version":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":8191,"type":"keyword"},"changes":{"properties":{"components":{"properties":{"added":{"ignore_above":8191,"type":"keyword"},"count":{"type":"long"},"updated":{"ignore_above":8191,"type":"keyword"}}},"outputs":{"type":"object"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"component":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"old_state":{"ignore_above":8191,"type":"keyword"},"state":{"ignore_above":8191,"type":"keyword"}}},"component_ids":{"ignore_above":8191,"type":"keyword"},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"context":{"ignore_above":8191,"type":"keyword"},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dir":{"ignore_above":8191,"type":"keyword"},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"float_gauges":{"type":"long"},"float_keys":{"type":"long"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"input_float_gauges":{"type":"long"},"input_int_counters":{"type":"long"},"input_int_gauges":{"type":"long"},"inputs":{"ignore_above":8191,"type":"keyword"},"int_counters":{"type":"long"},"int_gauges":{"type":"long"},"int_keys":{"type":"long"},"log":{"properties":{"file":{"properties":{"fingerprint":{"ignore_above":8191,"type":"keyword"},"idxhi":{"ignore_above":8191,"type":"keyword"},"idxlo":{"ignore_above":8191,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"vol":{"ignore_above":8191,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"},"logger":{"ignore_above":8191,"type":"keyword"},"offset":{"type":"long"},"origin":{"properties":{"file":{"properties":{"line":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}},"function":{"ignore_above":8191,"type":"keyword"}}},"source":{"ignore_above":8191,"type":"keyword"}}},"message":{"type":"match_only_text"},"meter_provider_type":{"ignore_above":8191,"type":"keyword"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"otelcol":{"properties":{"component":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"kind":{"ignore_above":8191,"type":"keyword"}}},"pipeline":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}},"signal":{"ignore_above":8191,"type":"keyword"}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":8191,"type":"keyword"},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"processor_name":{"ignore_above":8191,"type":"keyword"},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"resource":{"properties":{"service":{"properties":{"instance":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}},"name":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"signal":{"ignore_above":8191,"type":"keyword"},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"total_instruments":{"type":"long"},"unit":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"old_state":{"ignore_above":8191,"type":"keyword"},"state":{"ignore_above":8191,"type":"keyword"},"type":{"ignore_above":8191,"type":"keyword"}}},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"elastic_agent.endpoint_security","index":"logs-elastic_agent.endpoint_security-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"component":{"properties":{"binary":{"ignore_above":8191,"type":"keyword"},"dataset":{"ignore_above":8191,"type":"keyword"},"id":{"ignore_above":8191,"type":"keyword"},"type":{"ignore_above":8191,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"fingerprint":{"ignore_above":8191,"type":"keyword"},"idxhi":{"ignore_above":8191,"type":"keyword"},"idxlo":{"ignore_above":8191,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"vol":{"ignore_above":8191,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"},"offset":{"type":"long"},"origin":{"properties":{"file":{"properties":{"line":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}}}},"source":{"ignore_above":8191,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"elastic_agent.filebeat","index":"logs-elastic_agent.filebeat-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"batch_size":{"type":"long"},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"component":{"properties":{"binary":{"ignore_above":8191,"type":"keyword"},"dataset":{"ignore_above":8191,"type":"keyword"},"id":{"ignore_above":8191,"type":"keyword"},"type":{"ignore_above":8191,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"deprecated":{"type":"boolean"},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"id":{"ignore_above":8191,"type":"keyword"},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"input_id":{"ignore_above":8191,"type":"keyword"},"input_source":{"ignore_above":8191,"type":"keyword"},"input_type":{"ignore_above":8191,"type":"keyword"},"log":{"properties":{"file":{"properties":{"fingerprint":{"ignore_above":8191,"type":"keyword"},"idxhi":{"ignore_above":8191,"type":"keyword"},"idxlo":{"ignore_above":8191,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"vol":{"ignore_above":8191,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"},"logger":{"ignore_above":8191,"type":"keyword"},"offset":{"type":"long"},"origin":{"properties":{"file":{"properties":{"line":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}},"function":{"ignore_above":8191,"type":"keyword"}}},"source":{"ignore_above":8191,"type":"keyword"}}},"message":{"type":"match_only_text"},"monitoring":{"properties":{"ecs":{"properties":{"version":{"ignore_above":8191,"type":"keyword"}}},"info":{"properties":{"beat":{"ignore_above":8191,"type":"keyword"},"binary_arch":{"ignore_above":8191,"type":"keyword"},"build_commit":{"ignore_above":8191,"type":"keyword"},"build_time":{"ignore_above":8191,"type":"keyword"},"elastic_licensed":{"type":"boolean"},"ephemeral_id":{"ignore_above":8191,"type":"keyword"},"gid":{"ignore_above":8191,"type":"keyword"},"hostname":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"uid":{"ignore_above":8191,"type":"keyword"},"username":{"ignore_above":8191,"type":"keyword"},"uuid":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}},"metrics":{"properties":{"amqp":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"beat":{"properties":{"cpu":{"properties":{"system":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}}}},"total":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}},"value":{"type":"float"}}},"user":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}}}}}},"info":{"properties":{"ephemeral_id":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"uptime":{"properties":{"ms":{"type":"long"}}},"version":{"ignore_above":8191,"type":"keyword"}}},"memstats":{"properties":{"gc_next":{"type":"long"},"memory_alloc":{"type":"long"},"memory_sys":{"type":"long"},"memory_total":{"type":"long"},"rss":{"type":"long"}}},"runtime":{"properties":{"goroutines":{"type":"long"}}}}},"dhcpv4":{"properties":{"parse_failures":{"type":"long"},"total_packets":{"type":"long"}}},"dns":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"filebeat":{"properties":{"events":{"properties":{"active":{"type":"long"},"added":{"type":"long"},"done":{"type":"long"}}},"harvester":{"properties":{"closed":{"type":"long"},"open_files":{"type":"long"},"running":{"type":"long"},"skipped":{"type":"long"},"started":{"type":"long"}}},"input":{"properties":{"log":{"properties":{"files":{"properties":{"renamed":{"type":"long"},"truncated":{"type":"long"}}}}}}}}},"heartbeat":{"properties":{"config":{"properties":{"module":{"properties":{"running":{"type":"long"},"starts":{"type":"long"},"stops":{"type":"long"}}}}},"http":{"properties":{"endpoint_starts":{"type":"long"},"endpoint_stops":{"type":"long"},"monitor_starts":{"type":"long"},"monitor_stops":{"type":"long"}}},"icmp":{"properties":{"endpoint_starts":{"type":"long"},"endpoint_stops":{"type":"long"},"monitor_starts":{"type":"long"},"monitor_stops":{"type":"long"}}},"tcp":{"properties":{"endpoint_starts":{"type":"long"},"endpoint_stops":{"type":"long"},"monitor_starts":{"type":"long"},"monitor_stops":{"type":"long"}}}}},"http":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"icmp":{"properties":{"duplicate_requests":{"type":"long"},"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"libbeat":{"properties":{"config":{"properties":{"module":{"properties":{"running":{"type":"long"},"starts":{"type":"long"},"stops":{"type":"long"}}},"reloads":{"type":"long"},"scans":{"type":"long"}}},"output":{"properties":{"batches":{"properties":{"split":{"type":"long"}}},"events":{"properties":{"acked":{"type":"long"},"active":{"type":"long"},"batches":{"type":"long"},"dead_letter":{"type":"long"},"dropped":{"type":"long"},"duplicates":{"type":"long"},"failed":{"type":"long"},"failure_store":{"type":"long"},"toomany":{"type":"long"},"total":{"type":"long"}}},"read":{"properties":{"bytes":{"type":"long"},"errors":{"type":"long"}}},"type":{"ignore_above":8191,"type":"keyword"},"write":{"properties":{"bytes":{"type":"long"},"errors":{"type":"long"},"latency":{"properties":{"histogram":{"properties":{"count":{"type":"long"},"max":{"type":"long"},"mean":{"type":"float"},"median":{"type":"long"},"min":{"type":"long"},"p75":{"type":"float"},"p95":{"type":"float"},"p99":{"type":"long"},"p999":{"type":"long"},"stddev":{"type":"float"}}}}},"latency_delta":{"properties":{"histogram":{"properties":{"count":{"type":"long"},"max":{"type":"long"},"median":{"type":"long"},"min":{"type":"long"},"p99":{"type":"long"}}}}}}}}}}},"memcache":{"properties":{"unfinished_transactions":{"type":"long"},"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"mongodb":{"properties":{"unmatched_requests":{"type":"long"}}},"mysql":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"nfs":{"properties":{"unmatched_requests":{"type":"long"}}},"pgsql":{"properties":{"unmatched_responses":{"type":"long"}}},"processor":{"properties":{"add_host_metadata":{"properties":{"fqdn_lookup_failed":{"type":"long"}}}}},"redis":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}},"registrar":{"properties":{"states":{"properties":{"cleanup":{"type":"long"},"current":{"type":"long"},"update":{"type":"long"}}},"writes":{"properties":{"fail":{"type":"long"},"success":{"type":"long"},"total":{"type":"long"}}}}},"system":{"properties":{"cpu":{"properties":{"cores":{"type":"long"}}},"handles":{"properties":{"open":{"type":"long"}}}}},"thrift":{"properties":{"unmatched_requests":{"type":"long"},"unmatched_responses":{"type":"long"}}}}},"state":{"properties":{"beat":{"properties":{"name":{"ignore_above":8191,"type":"keyword"}}},"heartbeat":{"properties":{"endpoints":{"type":"long"},"http":{"properties":{"endpoints":{"type":"long"},"monitors":{"type":"long"}}},"icmp":{"properties":{"endpoints":{"type":"long"},"monitors":{"type":"long"}}},"monitors":{"type":"long"},"tcp":{"properties":{"endpoints":{"type":"long"},"monitors":{"type":"long"}}}}},"host":{"properties":{"architecture":{"ignore_above":8191,"type":"keyword"},"hostname":{"ignore_above":8191,"type":"keyword"},"id":{"ignore_above":8191,"type":"keyword"},"os":{"properties":{"build":{"ignore_above":8191,"type":"keyword"},"family":{"ignore_above":8191,"type":"keyword"},"kernel":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"platform":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}},"input":{"properties":{"count":{"type":"long"}}},"management":{"properties":{"enabled":{"type":"boolean"}}},"module":{"properties":{"count":{"type":"long"}}},"output":{"properties":{"batch_size":{"type":"long"},"clients":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}},"outputs":{"properties":{"elasticsearch":{"properties":{"cluster_uuid":{"ignore_above":8191,"type":"keyword"}}}}},"queue":{"properties":{"name":{"ignore_above":8191,"type":"keyword"}}},"service":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}}}},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"num_returned":{"type":"long"},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"registry_id":{"ignore_above":8191,"type":"keyword"},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"stability":{"ignore_above":8191,"type":"keyword"},"store":{"ignore_above":8191,"type":"keyword"},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"elastic_agent.metricbeat","index":"logs-elastic_agent.metricbeat-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"component":{"properties":{"binary":{"ignore_above":8191,"type":"keyword"},"dataset":{"ignore_above":8191,"type":"keyword"},"id":{"ignore_above":8191,"type":"keyword"},"type":{"ignore_above":8191,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"fingerprint":{"ignore_above":8191,"type":"keyword"},"idxhi":{"ignore_above":8191,"type":"keyword"},"idxlo":{"ignore_above":8191,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"vol":{"ignore_above":8191,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"},"logger":{"ignore_above":8191,"type":"keyword"},"offset":{"type":"long"},"origin":{"properties":{"file":{"properties":{"line":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}},"function":{"ignore_above":8191,"type":"keyword"}}},"source":{"ignore_above":8191,"type":"keyword"}}},"message":{"type":"match_only_text"},"monitoring":{"properties":{"ecs":{"properties":{"version":{"ignore_above":8191,"type":"keyword"}}},"info":{"properties":{"beat":{"ignore_above":8191,"type":"keyword"},"binary_arch":{"ignore_above":8191,"type":"keyword"},"build_commit":{"ignore_above":8191,"type":"keyword"},"build_time":{"ignore_above":8191,"type":"keyword"},"elastic_licensed":{"type":"boolean"},"ephemeral_id":{"ignore_above":8191,"type":"keyword"},"gid":{"ignore_above":8191,"type":"keyword"},"hostname":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"uid":{"ignore_above":8191,"type":"keyword"},"username":{"ignore_above":8191,"type":"keyword"},"uuid":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}},"metrics":{"properties":{"beat":{"properties":{"cpu":{"properties":{"system":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}}}},"total":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}},"value":{"type":"float"}}},"user":{"properties":{"ticks":{"type":"long"},"time":{"properties":{"ms":{"type":"long"}}}}}}},"info":{"properties":{"ephemeral_id":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"uptime":{"properties":{"ms":{"type":"long"}}},"version":{"ignore_above":8191,"type":"keyword"}}},"memstats":{"properties":{"gc_next":{"type":"long"},"memory_alloc":{"type":"long"},"memory_sys":{"type":"long"},"memory_total":{"type":"long"},"rss":{"type":"long"}}},"runtime":{"properties":{"goroutines":{"type":"long"}}}}},"libbeat":{"properties":{"output":{"properties":{"batches":{"properties":{"split":{"type":"long"}}},"events":{"properties":{"acked":{"type":"long"},"active":{"type":"long"},"batches":{"type":"long"},"dead_letter":{"type":"long"},"dropped":{"type":"long"},"duplicates":{"type":"long"},"failed":{"type":"long"},"failure_store":{"type":"long"},"toomany":{"type":"long"},"total":{"type":"long"}}},"read":{"properties":{"bytes":{"type":"long"},"errors":{"type":"long"}}},"type":{"ignore_above":8191,"type":"keyword"},"write":{"properties":{"bytes":{"type":"long"},"errors":{"type":"long"},"latency":{"properties":{"histogram":{"properties":{"count":{"type":"long"},"max":{"type":"long"},"mean":{"type":"long"},"median":{"type":"long"},"min":{"type":"long"},"p75":{"type":"long"},"p95":{"type":"long"},"p99":{"type":"long"},"p999":{"type":"long"},"stddev":{"type":"long"}}}}},"latency_delta":{"properties":{"histogram":{"properties":{"count":{"type":"long"},"max":{"type":"long"},"median":{"type":"long"},"min":{"type":"long"},"p99":{"type":"long"}}}}}}}}},"pipeline":{"properties":{"clients":{"type":"long"},"events":{"properties":{"active":{"type":"long"},"dropped":{"type":"long"},"failed":{"type":"long"},"filtered":{"type":"long"},"published":{"type":"long"},"retry":{"type":"long"},"total":{"type":"long"}}},"queue":{"properties":{"acked":{"type":"long"},"added":{"properties":{"bytes":{"type":"long"},"events":{"type":"long"}}},"consumed":{"properties":{"bytes":{"type":"long"},"events":{"type":"long"}}},"filled":{"properties":{"bytes":{"type":"long"},"events":{"type":"long"},"pct":{"type":"float"}}},"max_bytes":{"type":"long"},"max_events":{"type":"long"},"removed":{"properties":{"bytes":{"type":"long"},"events":{"type":"long"}}}}}}}}},"system":{"properties":{"cpu":{"properties":{"cores":{"type":"long"}}},"handles":{"properties":{"open":{"type":"long"}}}}}}},"state":{"properties":{"beat":{"properties":{"name":{"ignore_above":8191,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":8191,"type":"keyword"},"hostname":{"ignore_above":8191,"type":"keyword"},"id":{"ignore_above":8191,"type":"keyword"},"os":{"properties":{"build":{"ignore_above":8191,"type":"keyword"},"family":{"ignore_above":8191,"type":"keyword"},"kernel":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"platform":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}},"output":{"properties":{"batch_size":{"type":"long"},"clients":{"type":"long"},"name":{"ignore_above":8191,"type":"keyword"}}},"queue":{"properties":{"name":{"ignore_above":8191,"type":"keyword"}}},"service":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"name":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}}}},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"otelcol":{"properties":{"component":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"kind":{"ignore_above":8191,"type":"keyword"}}},"signal":{"ignore_above":8191,"type":"keyword"}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"resource":{"properties":{"service":{"properties":{"instance":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}},"name":{"ignore_above":8191,"type":"keyword"},"version":{"ignore_above":8191,"type":"keyword"}}}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.api","index":"logs-endpoint.events.api-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.file","index":"logs-endpoint.events.file-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.library","index":"logs-endpoint.events.library-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.network","index":"logs-endpoint.events.network-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"destination":{"properties":{"port":{"type":"long"}}},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.process","index":"logs-endpoint.events.process-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.registry","index":"logs-endpoint.events.registry-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"endpoint.events.security","index":"logs-endpoint.events.security-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic":{"properties":{"agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"}}}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"VirtualAccount":{"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"system.application","index":"logs-system.application-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttachedFiles":{"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BucketType":{"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CabGuid":{"type":"keyword"},"CabId":{"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"Context":{"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventName":{"type":"keyword"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MessageText":{"type":"keyword"},"Method":{"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"P1":{"type":"keyword"},"P2":{"type":"keyword"},"P3":{"type":"keyword"},"P4":{"type":"keyword"},"P5":{"type":"keyword"},"P6":{"type":"keyword"},"P7":{"type":"keyword"},"P8":{"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"Rechecking":{"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"ReportId":{"type":"keyword"},"ReportStatus":{"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"Response":{"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"Stage":{"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"StorePath":{"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"Url":{"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param10":{"type":"keyword"},"param11":{"type":"keyword"},"param12":{"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"},"param9":{"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"system.security","index":"logs-system.security-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"device":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"model":{"properties":{"name":{"ignore_above":8191,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"domain":{"ignore_above":8191,"type":"keyword"},"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":8191,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountAvailableKeys":{"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"AccountSupportedEncryptionTypes":{"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AdvancedOptions":{"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientAdvertizedEncryptionTypes":{"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"ClientProcessStartKey":{"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"ConfigAccessPolicy":{"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DCAvailableKeys":{"type":"keyword"},"DCSupportedEncryptionTypes":{"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisableIntegrityChecks":{"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"ElevatedToken":{"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FQDN":{"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"FlightSigning":{"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"HypervisorDebug":{"type":"keyword"},"HypervisorLaunchType":{"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KernelDebug":{"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"NotificationPackageName":{"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessId":{"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthEncryptionType":{"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteEventLogging":{"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"RequestTicketHash":{"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ResponseTicket":{"type":"keyword"},"ResponseTicketHash":{"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RpcCallClientLocality":{"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"SecurityPackageName":{"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceAvailableKeys":{"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceSupportedEncryptionTypes":{"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionKeyEncryptionType":{"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetProcessName":{"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"TestSigning":{"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"VirtualAccount":{"type":"keyword"},"VsmLaunchType":{"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"system.system","index":"logs-system.system-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AADDomainJoin":{"type":"keyword"},"ADDomainJoin":{"type":"keyword"},"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdapterName":{"type":"keyword"},"AdapterSuffixName":{"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"Address":{"type":"keyword"},"AddressLength":{"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttemptedRecoveryEnforcementSucceeded":{"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootId":{"type":"keyword"},"BootMenuPolicy":{"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootStatusPolicy":{"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BucketId":{"type":"keyword"},"BufferFlushNeeded":{"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CacheFlushNeeded":{"type":"keyword"},"CacheFlushSupported":{"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessImageName":{"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientPID":{"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CmosTime":{"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Config":{"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountNew":{"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CountOld":{"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentBias":{"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"CurrentStratumNumber":{"type":"keyword"},"CurrentTimeZoneID":{"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DCName":{"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Default SD String:":{"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceAttributes":{"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DirtyPages":{"type":"keyword"},"DisabledLoadOption":{"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"DnsServerList":{"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainController":{"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPeer":{"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EfiDaylightFlags":{"type":"keyword"},"EfiTime":{"type":"keyword"},"EfiTimeZoneBias":{"type":"keyword"},"EnableDisableReason":{"type":"keyword"},"Enabled":{"type":"keyword"},"EnabledFeatures":{"type":"keyword"},"EnabledNew":{"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"ErrorDescription":{"type":"keyword"},"ErrorMessage":{"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"ExecutablePath":{"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExitReason":{"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"FirstRefresh":{"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GracePeriod":{"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HRESULT":{"type":"keyword"},"HalRtcErrorCode":{"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareChecks":{"type":"keyword"},"HardwareEnabled":{"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HardwarePresent":{"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HiveName":{"type":"keyword"},"HiveNameLength":{"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"HostName":{"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImageName":{"type":"keyword"},"ImagePath":{"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"InternalBootFlags":{"type":"keyword"},"InternalInfo":{"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"Ipaddress":{"type":"keyword"},"IsAutoEnabled":{"type":"keyword"},"IsLicensed":{"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"IsSoftBoot":{"type":"keyword"},"IsTestConfig":{"type":"keyword"},"Json":{"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"KeysUpdated":{"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastBootId":{"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"Level":{"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LoadOptions":{"type":"keyword"},"LoaderTime":{"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MdClearSupported":{"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPasswordLength":{"type":"keyword"},"MinimumPasswordLengthAudit":{"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"MonitorReason":{"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewLatchTimerNeeded":{"type":"keyword"},"NewLatchTimerWaitingSystemUpdateCompletion":{"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewSize":{"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewTimerNeeded":{"type":"keyword"},"NewTimerWaitingUpdateCompletion":{"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NextSessionId":{"type":"keyword"},"NextSessionType":{"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"NormalProcessId":{"type":"keyword"},"NotAffectedAtom":{"type":"keyword"},"NotAffectedMdsNo":{"type":"keyword"},"NotAffectedRdclNo":{"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"NumberOfGroupPolicyObjects":{"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"OriginalSize":{"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentHypervisorFlushes":{"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Phase":{"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Policy":{"type":"keyword"},"PolicyFileExists":{"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PowerStateAc":{"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousEnergyCapacityAtEnd":{"type":"keyword"},"PreviousEnergyCapacityAtStart":{"type":"keyword"},"PreviousFullEnergyCapacityAtEnd":{"type":"keyword"},"PreviousFullEnergyCapacityAtStart":{"type":"keyword"},"PreviousLatchTimerExistsButDisabled":{"type":"keyword"},"PreviousSessionDurationInUs":{"type":"keyword"},"PreviousSessionId":{"type":"keyword"},"PreviousSessionType":{"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"PreviousTimerExists":{"type":"keyword"},"PreviousTimerExistsButDisabled":{"type":"keyword"},"PreviousTimerStartTime":{"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"Problems":{"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"ProcessingMode":{"type":"keyword"},"ProcessingTimeInMilliseconds":{"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"QueryName":{"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"RealTimeIsUniversal":{"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"RelaxMinimumPasswordLengthLimits":{"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"ReserveStatus":{"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"RetryMinutes":{"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"SchedulerType":{"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Sent UpdateServer":{"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SmtEnabled":{"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartType":{"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"Success":{"type":"keyword"},"SupportInfo1":{"type":"keyword"},"SupportInfo2":{"type":"keyword"},"SystemInCmosMode":{"type":"keyword"},"SystemTime":{"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TimeDeltaInMs":{"type":"keyword"},"TimeSource":{"type":"keyword"},"TimeSourceRefId":{"type":"keyword"},"TimeZoneBias":{"type":"keyword"},"TimeZoneInfoCacheUpdated":{"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"TrustletIdentity":{"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"UpdateReason":{"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"Url":{"type":"keyword"},"UrlGroupId":{"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"VsmPolicy":{"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"driverFile":{"type":"keyword"},"error":{"type":"keyword"},"lineNumber":{"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param10":{"type":"keyword"},"param11":{"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"},"param9":{"type":"keyword"},"spn1":{"type":"keyword"},"spn2":{"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"windows.powershell","index":"logs-windows.powershell-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"windows.powershell_operational","index":"logs-windows.powershell_operational-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"$InboxIMEs":{"type":"keyword"},"$Res":{"type":"keyword"},"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"ContextInfo":{"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"Host Application":{"type":"keyword"},"Host ID":{"type":"keyword"},"Host Name":{"type":"keyword"},"Host Version":{"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"Payload":{"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity":{"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"windows.sysmon_operational","index":"logs-windows.sysmon_operational-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"Contents":{"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"ParentUser":{"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"SourceUser":{"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUser":{"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}},{"dataset":"winlog.winlog","index":"logs-winlog.winlog-default","mappings":{"date_detection":false,"dynamic":"true","dynamic_templates":[{"winlog.event_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.event_data.*"}},{"winlog.user_data":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"winlog.user_data.*"}},{"container.labels":{"mapping":{"type":"keyword"},"match_mapping_type":"string","path_match":"container.labels.*"}},{"strings":{"mapping":{"ignore_above":8191,"type":"keyword"},"match_mapping_type":"string"}}],"properties":{"@timestamp":{"type":"date"},"@version":{"ignore_above":8191,"type":"keyword"},"Effective_process":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"trusted":{"type":"boolean"}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"Persistence":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"keepalive":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"runatload":{"type":"boolean"}}},"Target":{"properties":{"process":{"properties":{"Ext":{"properties":{"authentication_id":{"ignore_above":1024,"type":"keyword"},"created_suspended":{"type":"boolean"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"protection":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"}}},"token":{"properties":{"elevation":{"type":"boolean"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"}}}}},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"pid":{"type":"long"}}}}},"Tcc":{"properties":{"identity":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"},"right":{"ignore_above":1024,"type":"keyword"},"service":{"ignore_above":1024,"type":"keyword"},"update_type":{"ignore_above":1024,"type":"keyword"}}},"agent":{"properties":{"ephemeral_id":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"cloud":{"properties":{"account":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"availability_zone":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"instance":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"machine":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"project":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"provider":{"ignore_above":1024,"type":"keyword"},"region":{"ignore_above":1024,"type":"keyword"}}},"container":{"dynamic":"true","properties":{"id":{"ignore_above":1024,"type":"keyword"},"image":{"properties":{"hash":{"properties":{"all":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"tag":{"ignore_above":1024,"type":"keyword"}}},"labels":{"dynamic":"true","type":"object"},"name":{"ignore_above":1024,"type":"keyword"}}},"data_stream":{"properties":{"dataset":{"type":"keyword"},"namespace":{"type":"keyword"},"type":{"type":"keyword"}}},"dataset":{"properties":{"name":{"type":"constant_keyword"},"namespace":{"type":"constant_keyword"},"type":{"type":"constant_keyword"}}},"destination":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"dll":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"load_index":{"type":"unsigned_long"},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"size":{"type":"unsigned_long"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}}}},"dns":{"properties":{"Ext":{"properties":{"options":{"ignore_above":1024,"type":"keyword"},"status":{"type":"long"}}},"answers":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"data":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"ttl":{"type":"long"},"type":{"ignore_above":1024,"type":"keyword"}}},"header_flags":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"op_code":{"ignore_above":1024,"type":"keyword"},"question":{"properties":{"class":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"subdomain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"resolved_ip":{"type":"ip"},"response_code":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"ecs":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"elastic_agent":{"properties":{"id":{"ignore_above":8191,"type":"keyword"},"snapshot":{"type":"boolean"},"version":{"ignore_above":8191,"type":"keyword"}}},"error":{"properties":{"code":{"ignore_above":1024,"type":"keyword"},"message":{"type":"match_only_text"}}},"event":{"properties":{"Ext":{"properties":{"correlation":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}}}},"action":{"ignore_above":1024,"type":"keyword"},"agent_id_status":{"ignore_above":8191,"type":"keyword"},"category":{"ignore_above":1024,"type":"keyword"},"code":{"ignore_above":1024,"type":"keyword"},"created":{"type":"date"},"dataset":{"type":"keyword"},"end":{"type":"date"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ingested":{"type":"date"},"kind":{"ignore_above":1024,"type":"keyword"},"module":{"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"provider":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"severity":{"type":"long"},"start":{"type":"date"},"type":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"Ext":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"entropy":{"type":"double"},"header_bytes":{"ignore_above":1024,"type":"keyword"},"header_data":{"type":"text"},"malware_signature":{"properties":{"all_names":{"type":"text"},"identifier":{"type":"text"},"primary":{"properties":{"matches":{"type":"nested"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}},"type":"nested"}},"type":"nested"},"secondary":{"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"monotonic_id":{"type":"unsigned_long"},"original":{"properties":{"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"accessed":{"type":"date"},"attributes":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"created":{"type":"date"},"ctime":{"type":"date"},"device":{"ignore_above":1024,"type":"keyword"},"directory":{"ignore_above":1024,"type":"keyword"},"drive_letter":{"ignore_above":1,"type":"keyword"},"extension":{"ignore_above":1024,"type":"keyword"},"gid":{"ignore_above":1024,"type":"keyword"},"group":{"ignore_above":1024,"type":"keyword"},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"inode":{"ignore_above":1024,"type":"keyword"},"mime_type":{"ignore_above":1024,"type":"keyword"},"mode":{"ignore_above":1024,"type":"keyword"},"modified":{"type":"date"},"mtime":{"type":"date"},"name":{"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"owner":{"ignore_above":1024,"type":"keyword"},"path":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"size":{"type":"long"},"target_path":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uid":{"ignore_above":1024,"type":"keyword"}}},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"host":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"boot":{"properties":{"id":{"ignore_above":1024,"type":"keyword"}}},"containerized":{"type":"boolean"},"domain":{"ignore_above":1024,"type":"keyword"},"hostname":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"mac":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"os":{"properties":{"Ext":{"properties":{"variant":{"ignore_above":1024,"type":"keyword"}}},"build":{"ignore_above":1024,"type":"keyword"},"codename":{"ignore_above":1024,"type":"keyword"},"family":{"ignore_above":1024,"type":"keyword"},"full":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"kernel":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"platform":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"pid_ns_ino":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"uptime":{"type":"long"}}},"http":{"properties":{"request":{"properties":{"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"method":{"ignore_above":1024,"type":"keyword"}}},"response":{"properties":{"Ext":{"properties":{"version":{"ignore_above":1024,"type":"keyword"}}},"body":{"properties":{"bytes":{"type":"long"},"content":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"bytes":{"type":"long"},"status_code":{"type":"long"}}}}},"index":{"properties":{"scanned_at":{"type":"date"}}},"input":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"log":{"properties":{"file":{"properties":{"path":{"ignore_above":1024,"type":"keyword"}}},"level":{"ignore_above":1024,"type":"keyword"}}},"message":{"type":"match_only_text"},"network":{"properties":{"bytes":{"type":"long"},"community_id":{"ignore_above":1024,"type":"keyword"},"direction":{"ignore_above":1024,"type":"keyword"},"iana_number":{"ignore_above":1024,"type":"keyword"},"packets":{"type":"long"},"protocol":{"ignore_above":1024,"type":"keyword"},"transport":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"orchestrator":{"properties":{"cluster":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"namespace":{"ignore_above":1024,"type":"keyword"},"resource":{"properties":{"ip":{"type":"ip"},"name":{"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"type":{"ignore_above":1024,"type":"keyword"}}}}},"package":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"powershell":{"properties":{"command":{"properties":{"invocation_details":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"related_command":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"},"value":{"type":"text"}}},"connected_user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"engine":{"properties":{"new_state":{"ignore_above":1024,"type":"keyword"},"previous_state":{"ignore_above":1024,"type":"keyword"},"version":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"script_block_entropy_bits":{"type":"float"},"script_block_entropy_normalized":{"type":"float"},"script_block_hash":{"ignore_above":1024,"type":"keyword"},"script_block_id":{"ignore_above":1024,"type":"keyword"},"script_block_length":{"type":"long"},"script_block_surprisal_stdev":{"type":"float"},"script_block_text":{"analyzer":"powershell_script_analyzer","type":"text"},"script_block_unique_symbols":{"type":"long"}}},"id":{"ignore_above":1024,"type":"keyword"},"pipeline_id":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"executable_version":{"ignore_above":1024,"type":"keyword"}}},"provider":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"new_state":{"ignore_above":1024,"type":"keyword"}}},"runspace_id":{"ignore_above":1024,"type":"keyword"},"sequence":{"type":"long"},"total":{"type":"long"}}},"process":{"properties":{"Ext":{"properties":{"ancestry":{"ignore_above":1024,"type":"keyword"},"api":{"properties":{"behaviors":{"ignore_above":1024,"type":"keyword"},"metadata":{"properties":{"amsi_filenames":{"ignore_above":1024,"type":"keyword"},"amsi_logs":{"properties":{"entries":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"background_callcount":{"type":"unsigned_long"},"client_is_local":{"type":"boolean"},"client_machine":{"ignore_above":1024,"type":"keyword"},"client_machine_fqdn":{"ignore_above":1024,"type":"keyword"},"client_process_id":{"type":"unsigned_long"},"ms_since_last_keyevent":{"type":"unsigned_long"},"procedure_symbol":{"ignore_above":1024,"type":"keyword"},"return_value":{"type":"unsigned_long"},"security_descriptor":{"ignore_above":1024,"type":"keyword"},"start_address_allocation_protection":{"ignore_above":1024,"type":"keyword"},"start_address_module":{"ignore_above":1024,"type":"keyword"},"target_address_name":{"ignore_above":1024,"type":"keyword"},"target_address_path":{"ignore_above":1024,"type":"keyword"},"thread_info_flags":{"type":"unsigned_long"},"visible_windows_count":{"type":"unsigned_long"},"windows_count":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"parameters":{"properties":{"address":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"app_name":{"ignore_above":1024,"type":"keyword"},"argument1":{"type":"unsigned_long"},"argument2":{"type":"unsigned_long"},"argument3":{"type":"unsigned_long"},"attribute_list":{"ignore_above":1024,"type":"keyword"},"buffer":{"ignore_above":1024,"type":"keyword"},"consumer_details":{"ignore_above":1024,"type":"keyword"},"consumer_name":{"ignore_above":1024,"type":"keyword"},"consumer_type":{"ignore_above":1024,"type":"keyword"},"content_name":{"ignore_above":1024,"type":"keyword"},"context_flags":{"type":"unsigned_long"},"desired_access":{"ignore_above":1024,"type":"keyword"},"desired_access_numeric":{"type":"long"},"device":{"ignore_above":1024,"type":"keyword"},"distinguished_name":{"ignore_above":1024,"type":"keyword"},"driver":{"ignore_above":1024,"type":"keyword"},"eax":{"type":"unsigned_long"},"ebp":{"type":"unsigned_long"},"ebx":{"type":"unsigned_long"},"ecx":{"type":"unsigned_long"},"edi":{"type":"unsigned_long"},"edx":{"type":"unsigned_long"},"eip":{"type":"unsigned_long"},"esi":{"type":"unsigned_long"},"esp":{"type":"unsigned_long"},"event_filter_details":{"ignore_above":1024,"type":"keyword"},"event_filter_name":{"ignore_above":1024,"type":"keyword"},"flags":{"ignore_above":1024,"type":"keyword"},"handle_type":{"ignore_above":1024,"type":"keyword"},"hook_module":{"ignore_above":1024,"type":"keyword"},"hook_type":{"ignore_above":1024,"type":"keyword"},"io_control_code":{"type":"unsigned_long"},"namespace":{"ignore_above":1024,"type":"keyword"},"operation":{"ignore_above":1024,"type":"keyword"},"procedure":{"type":"unsigned_long"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_old":{"ignore_above":1024,"type":"keyword"},"r8":{"type":"unsigned_long"},"r9":{"type":"unsigned_long"},"rax":{"type":"unsigned_long"},"rbp":{"type":"unsigned_long"},"rbx":{"ignore_above":1024,"type":"keyword"},"rcx":{"type":"unsigned_long"},"rdi":{"type":"unsigned_long"},"rdx":{"type":"unsigned_long"},"rip":{"type":"unsigned_long"},"rsi":{"ignore_above":1024,"type":"keyword"},"rsp":{"type":"unsigned_long"},"scope_of_search":{"ignore_above":1024,"type":"keyword"},"search_filter":{"ignore_above":1024,"type":"keyword"},"size":{"type":"unsigned_long"},"usage":{"ignore_above":1024,"type":"keyword"},"usage_page":{"ignore_above":1024,"type":"keyword"}}},"summary":{"ignore_above":1024,"type":"keyword"}}},"architecture":{"ignore_above":1024,"type":"keyword"},"authentication_id":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"created_suspended":{"type":"boolean"},"defense_evasions":{"ignore_above":1024,"type":"keyword"},"desktop_name":{"ignore_above":1024,"type":"keyword"},"device":{"properties":{"bus_type":{"ignore_above":1024,"type":"keyword"},"dos_name":{"ignore_above":1024,"type":"keyword"},"file_system_type":{"ignore_above":1024,"type":"keyword"},"nt_name":{"ignore_above":1024,"type":"keyword"},"product_id":{"ignore_above":1024,"type":"keyword"},"serial_number":{"ignore_above":1024,"type":"keyword"},"vendor_id":{"ignore_above":1024,"type":"keyword"},"volume_device_type":{"ignore_above":1024,"type":"keyword"}}},"dll":{"properties":{"Ext":{"properties":{"mapped_address":{"type":"unsigned_long"},"mapped_size":{"type":"unsigned_long"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"}}},"effective_parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"}}},"memfd":{"properties":{"flag_allow_seal":{"type":"boolean"},"flag_cloexec":{"type":"boolean"},"flag_exec":{"type":"boolean"},"flag_hugetlb":{"type":"boolean"},"flag_noexec_seal":{"type":"boolean"},"flags":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"memory_region":{"properties":{"allocation_base":{"type":"unsigned_long"},"allocation_protection":{"ignore_above":1024,"type":"keyword"},"allocation_size":{"type":"unsigned_long"},"allocation_type":{"ignore_above":1024,"type":"keyword"},"bytes_address":{"type":"unsigned_long"},"bytes_allocation_offset":{"type":"unsigned_long"},"bytes_compressed":{"doc_values":false,"index":false,"type":"keyword"},"bytes_compressed_present":{"type":"boolean"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"malware_signature":{"properties":{"all_names":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"primary":{"properties":{"matches":{"doc_values":false,"index":false,"type":"keyword"},"signature":{"properties":{"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"secondary":{"enabled":false,"properties":{"matches":{"ignore_above":1024,"type":"keyword"},"signature":{"properties":{"hash":{"enabled":false,"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}},"type":"nested"},"version":{"ignore_above":1024,"type":"keyword"}}},"mapped_path":{"ignore_above":1024,"type":"keyword"},"mapped_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"mapped_pe_detected":{"type":"boolean"},"memory_pe":{"properties":{"Ext":{"properties":{"dotnet":{"type":"boolean"},"sections":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}},"streams":{"properties":{"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha384":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"},"ssdeep":{"ignore_above":1024,"type":"keyword"},"tlsh":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"}}}}},"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"go_import_hash":{"ignore_above":1024,"type":"keyword"},"go_imports":{"type":"flattened"},"go_imports_names_entropy":{"type":"long"},"go_imports_names_var_entropy":{"type":"long"},"go_stripped":{"type":"boolean"},"imphash":{"ignore_above":1024,"type":"keyword"},"import_hash":{"ignore_above":1024,"type":"keyword"},"imports":{"type":"flattened"},"imports_names_entropy":{"type":"long"},"imports_names_var_entropy":{"type":"long"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"pehash":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"},"sections":{"properties":{"entropy":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"},"physical_size":{"type":"long"},"var_entropy":{"type":"long"},"virtual_size":{"type":"long"}},"type":"nested"}}},"memory_pe_detected":{"type":"boolean"},"region_base":{"type":"unsigned_long"},"region_protection":{"ignore_above":1024,"type":"keyword"},"region_size":{"type":"unsigned_long"},"region_start_bytes":{"ignore_above":1024,"type":"keyword"},"region_state":{"ignore_above":1024,"type":"keyword"},"strings":{"doc_values":false,"index":false,"type":"keyword"}}},"mitigation_policies":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"ptrace":{"properties":{"addr":{"type":"long"},"child_pid":{"type":"long"},"data":{"type":"long"},"request":{"type":"long"}}},"relative_file_creation_time":{"type":"double"},"relative_file_name_modify_time":{"type":"double"},"script":{"properties":{"content":{"type":"match_only_text"},"path":{"ignore_above":1024,"type":"keyword"}}},"session":{"ignore_above":1024,"type":"keyword"},"session_info":{"properties":{"authentication_package":{"ignore_above":1024,"type":"keyword"},"client_address":{"ignore_above":1024,"type":"keyword"},"failure_reason":{"ignore_above":1024,"type":"keyword"},"id":{"type":"unsigned_long"},"logon_process_name":{"ignore_above":1024,"type":"keyword"},"logon_type":{"ignore_above":1024,"type":"keyword"},"relative_logon_time":{"type":"double"},"relative_password_age":{"type":"double"},"user_flags":{"ignore_above":1024,"type":"keyword"}}},"shmget":{"properties":{"flags":{"type":"long"},"key":{"type":"long"},"size":{"type":"long"}}},"token":{"properties":{"elevation":{"type":"boolean"},"elevation_level":{"ignore_above":1024,"type":"keyword"},"elevation_type":{"ignore_above":1024,"type":"keyword"},"impersonation_level":{"ignore_above":1024,"type":"keyword"},"integrity_level_name":{"ignore_above":1024,"type":"keyword"},"security_attributes":{"ignore_above":1024,"type":"keyword"}}},"trusted":{"type":"boolean"},"trusted_descendant":{"type":"boolean"},"windows":{"properties":{"zone_identifier":{"ignore_above":1024,"type":"keyword"}}}}},"ai_agent":{"properties":{"is_descendant":{"type":"boolean"},"name":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"end":{"type":"date"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"attested_groups":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"attested_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"entry_meta":{"properties":{"source":{"properties":{"ip":{"type":"ip"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"env_vars":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"io":{"properties":{"max_bytes_per_process_exceeded":{"type":"boolean"},"text":{"ignore_above":1024,"type":"wildcard"},"total_bytes_captured":{"type":"long"},"total_bytes_skipped":{"type":"long"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"origin_referrer_url":{"ignore_above":8192,"type":"keyword"},"origin_url":{"ignore_above":8192,"type":"keyword"},"parent":{"properties":{"Ext":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"protection":{"ignore_above":1024,"type":"keyword"},"real":{"properties":{"pid":{"type":"long"}}},"user":{"ignore_above":1024,"type":"keyword"}}},"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"signing_id":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"team_id":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}}},"command_line":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"exit_code":{"type":"long"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"group_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"hash":{"properties":{"md5":{"ignore_above":1024,"type":"keyword"},"sha1":{"ignore_above":1024,"type":"keyword"},"sha256":{"ignore_above":1024,"type":"keyword"},"sha512":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"pe":{"properties":{"architecture":{"ignore_above":1024,"type":"keyword"},"company":{"ignore_above":1024,"type":"keyword"},"description":{"ignore_above":1024,"type":"keyword"},"file_version":{"ignore_above":1024,"type":"keyword"},"imphash":{"ignore_above":1024,"type":"keyword"},"original_file_name":{"ignore_above":1024,"type":"keyword"},"product":{"ignore_above":1024,"type":"keyword"}}},"pgid":{"type":"long"},"pid":{"type":"long"},"ppid":{"type":"long"},"previous":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"session_leader":{"properties":{"args":{"ignore_above":1024,"type":"keyword"},"args_count":{"type":"long"},"command_line":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"wildcard"},"entity_id":{"ignore_above":1024,"type":"keyword"},"executable":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"interactive":{"type":"boolean"},"name":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"},"parent":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"session_leader":{"properties":{"entity_id":{"ignore_above":1024,"type":"keyword"},"pid":{"type":"long"},"start":{"type":"date"}}},"start":{"type":"date"}}},"pid":{"type":"long"},"real_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"real_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"same_as_process":{"type":"boolean"},"saved_group":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"saved_user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}}}},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"caseless":{"ignore_above":1024,"normalizer":"lowercase","type":"keyword"},"text":{"type":"text"}},"ignore_above":1024,"type":"keyword"}}},"start":{"type":"date"},"supplemental_groups":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"thread":{"properties":{"Ext":{"properties":{"call_stack":{"enabled":false,"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"callsite_leading_bytes":{"ignore_above":1024,"type":"keyword"},"callsite_trailing_bytes":{"ignore_above":1024,"type":"keyword"},"instruction_pointer":{"ignore_above":1024,"type":"keyword"},"module_path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"symbol_info":{"ignore_above":1024,"type":"keyword"}}},"call_stack_contains_unbacked":{"type":"boolean"},"call_stack_final_hook_module":{"properties":{"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"path":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_final_user_module":{"properties":{"allocation_private_bytes":{"type":"unsigned_long"},"code_signature":{"properties":{"exists":{"type":"boolean"},"status":{"ignore_above":1024,"type":"keyword"},"subject_name":{"ignore_above":1024,"type":"keyword"},"thumbprint_sha256":{"ignore_above":64,"type":"keyword"},"trusted":{"type":"boolean"},"valid":{"type":"boolean"}},"type":"nested"},"hash":{"properties":{"sha256":{"ignore_above":1024,"type":"keyword"}}},"name":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"protection":{"ignore_above":1024,"type":"keyword"},"protection_provenance":{"ignore_above":1024,"type":"keyword"},"protection_provenance_path":{"ignore_above":1024,"type":"keyword"},"reason":{"ignore_above":1024,"type":"keyword"}},"type":"nested"},"call_stack_summary":{"ignore_above":1024,"type":"keyword"},"hardware_breakpoint_set":{"type":"boolean"}}},"capabilities":{"properties":{"effective":{"ignore_above":1024,"type":"keyword"},"permitted":{"ignore_above":1024,"type":"keyword"}}},"id":{"type":"long"},"name":{"ignore_above":1024,"type":"keyword"}}},"title":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"tty":{"properties":{"char_device":{"properties":{"major":{"type":"long"},"minor":{"type":"long"}}},"columns":{"type":"long"},"rows":{"type":"long"}}},"uptime":{"type":"long"},"user":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"registry":{"properties":{"data":{"properties":{"bytes":{"ignore_above":1024,"type":"keyword"},"strings":{"ignore_above":1024,"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"}}},"hive":{"ignore_above":1024,"type":"keyword"},"key":{"ignore_above":1024,"type":"keyword"},"path":{"ignore_above":1024,"type":"keyword"},"value":{"ignore_above":1024,"type":"keyword"}}},"related":{"properties":{"hash":{"ignore_above":1024,"type":"keyword"},"hosts":{"ignore_above":1024,"type":"keyword"},"ip":{"type":"ip"},"user":{"ignore_above":1024,"type":"keyword"}}},"rule":{"properties":{"name":{"ignore_above":1024,"type":"keyword"}}},"service":{"properties":{"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"source":{"properties":{"address":{"ignore_above":1024,"type":"keyword"},"as":{"properties":{"number":{"type":"long"},"organization":{"properties":{"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"bytes":{"type":"long"},"domain":{"ignore_above":1024,"type":"keyword"},"geo":{"properties":{"city_name":{"ignore_above":1024,"type":"keyword"},"continent_code":{"ignore_above":1024,"type":"keyword"},"continent_name":{"ignore_above":1024,"type":"keyword"},"country_iso_code":{"ignore_above":1024,"type":"keyword"},"country_name":{"ignore_above":1024,"type":"keyword"},"location":{"type":"geo_point"},"name":{"ignore_above":1024,"type":"keyword"},"postal_code":{"ignore_above":1024,"type":"keyword"},"region_iso_code":{"ignore_above":1024,"type":"keyword"},"region_name":{"ignore_above":1024,"type":"keyword"},"timezone":{"ignore_above":1024,"type":"keyword"}}},"ip":{"type":"ip"},"packets":{"type":"long"},"port":{"type":"long"},"registered_domain":{"ignore_above":1024,"type":"keyword"},"top_level_domain":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"sysmon":{"properties":{"dns":{"properties":{"status":{"ignore_above":1024,"type":"keyword"}}},"file":{"properties":{"archived":{"type":"boolean"},"is_executable":{"type":"boolean"}}}}},"tags":{"ignore_above":1024,"type":"keyword"},"url":{"properties":{"full":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"wildcard"}}},"user":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"effective":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}},"email":{"ignore_above":1024,"type":"keyword"},"full_name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"group":{"properties":{"Ext":{"properties":{"real":{"properties":{"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}}}},"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"hash":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"},"target":{"properties":{"group":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"name":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":1024,"type":"keyword"}}}}},"windows_defender":{"properties":{"evidence_paths":{"ignore_above":1024,"type":"keyword"}}},"winlog":{"dynamic":"true","properties":{"activity_id":{"ignore_above":1024,"type":"keyword"},"api":{"ignore_above":1024,"type":"keyword"},"channel":{"ignore_above":1024,"type":"keyword"},"computerObject":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"id":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"}}},"computer_name":{"ignore_above":1024,"type":"keyword"},"event_data":{"dynamic":"true","properties":{"AS_security_intelligence_creation_time":{"type":"date"},"AS_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AV_security_intelligence_creation_time":{"type":"date"},"AV_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"AccessGranted":{"ignore_above":1024,"type":"keyword"},"AccessList":{"ignore_above":1024,"type":"keyword"},"AccessListDescription":{"ignore_above":1024,"type":"keyword"},"AccessMask":{"ignore_above":1024,"type":"keyword"},"AccessMaskDescription":{"ignore_above":1024,"type":"keyword"},"AccessReason":{"ignore_above":1024,"type":"keyword"},"AccessRemoved":{"ignore_above":1024,"type":"keyword"},"AccountDomain":{"ignore_above":1024,"type":"keyword"},"AccountExpires":{"ignore_above":1024,"type":"keyword"},"AccountMachine":{"type":"keyword"},"AccountName":{"ignore_above":1024,"type":"keyword"},"Action":{"ignore_above":1024,"type":"keyword"},"ActionName":{"type":"keyword"},"Action_ID":{"ignore_above":1024,"type":"keyword"},"Action_Name":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo":{"ignore_above":1024,"type":"keyword"},"AdditionalInfo2":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_ID":{"ignore_above":1024,"type":"keyword"},"Additional_Actions_String":{"ignore_above":1024,"type":"keyword"},"AlgorithmName":{"ignore_above":1024,"type":"keyword"},"AllowedToDelegateTo":{"ignore_above":1024,"type":"keyword"},"AppCorrelationID":{"ignore_above":1024,"type":"keyword"},"Application":{"ignore_above":1024,"type":"keyword"},"AttributeLDAPDisplayName":{"ignore_above":1024,"type":"keyword"},"AttributeSyntaxOID":{"ignore_above":1024,"type":"keyword"},"AttributeValue":{"ignore_above":5120,"type":"keyword"},"AuditPolicyChanges":{"ignore_above":1024,"type":"keyword"},"AuditPolicyChangesDescription":{"ignore_above":1024,"type":"keyword"},"AuditSourceName":{"ignore_above":1024,"type":"keyword"},"AuthenticationPackageName":{"ignore_above":1024,"type":"keyword"},"AvFlags":{"type":"keyword"},"AvFlagsStr":{"type":"keyword"},"BM_state":{"ignore_above":1024,"type":"keyword"},"BackupType":{"ignore_above":1024,"type":"keyword"},"BackupTypeDescription":{"ignore_above":1024,"type":"keyword"},"Binary":{"ignore_above":1024,"type":"keyword"},"BitlockerUserInputTime":{"ignore_above":1024,"type":"keyword"},"BootMode":{"ignore_above":1024,"type":"keyword"},"BootType":{"ignore_above":1024,"type":"keyword"},"BuildVersion":{"ignore_above":1024,"type":"keyword"},"CallTrace":{"ignore_above":1024,"type":"keyword"},"CallerProcessId":{"ignore_above":1024,"type":"keyword"},"CallerProcessName":{"ignore_above":1024,"type":"keyword"},"CalloutId":{"ignore_above":1024,"type":"keyword"},"CalloutKey":{"ignore_above":1024,"type":"keyword"},"CalloutName":{"ignore_above":1024,"type":"keyword"},"CalloutType":{"ignore_above":1024,"type":"keyword"},"Category":{"ignore_above":1024,"type":"keyword"},"CategoryId":{"ignore_above":1024,"type":"keyword"},"Category_ID":{"ignore_above":1024,"type":"keyword"},"Category_Name":{"ignore_above":1024,"type":"keyword"},"ChangeType":{"ignore_above":1024,"type":"keyword"},"ChannelBindingStatus":{"type":"keyword"},"ClassId":{"ignore_above":1024,"type":"keyword"},"ClassName":{"ignore_above":1024,"type":"keyword"},"ClientAddress":{"ignore_above":1024,"type":"keyword"},"ClientCreationTime":{"type":"date"},"ClientIP":{"type":"keyword"},"ClientInfo":{"ignore_above":1024,"type":"keyword"},"ClientName":{"ignore_above":1024,"type":"keyword"},"ClientNetworkName":{"type":"keyword"},"ClientProcessId":{"ignore_above":1024,"type":"keyword"},"CommandLine":{"ignore_above":1024,"type":"keyword"},"Company":{"ignore_above":1024,"type":"keyword"},"CompatibleIds":{"ignore_above":1024,"type":"keyword"},"ComputerAccountChange":{"ignore_above":1024,"type":"keyword"},"Conditions":{"ignore_above":1024,"type":"keyword"},"Configuration":{"ignore_above":1024,"type":"keyword"},"CorruptionActionState":{"ignore_above":1024,"type":"keyword"},"CountOfCredentialsReturned":{"ignore_above":1024,"type":"keyword"},"CrashOnAuditFailValue":{"ignore_above":1024,"type":"keyword"},"CreationUtcTime":{"ignore_above":1024,"type":"keyword"},"CryptoAlgorithms":{"ignore_above":1024,"type":"keyword"},"CurrentProfile":{"ignore_above":1024,"type":"keyword"},"Current_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Current_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"DCName":{"type":"keyword"},"DSName":{"ignore_above":1024,"type":"keyword"},"DSType":{"ignore_above":1024,"type":"keyword"},"DataDescription":{"ignore_above":1024,"type":"keyword"},"Description":{"ignore_above":1024,"type":"keyword"},"DestAddress":{"ignore_above":1024,"type":"keyword"},"DestPort":{"ignore_above":1024,"type":"keyword"},"Detail":{"ignore_above":1024,"type":"keyword"},"Details":{"ignore_above":1024,"type":"keyword"},"Detection_ID":{"ignore_above":1024,"type":"keyword"},"Detection_Time":{"type":"date"},"Detection_User":{"ignore_above":1024,"type":"keyword"},"DeviceDescription":{"ignore_above":1024,"type":"keyword"},"DeviceId":{"ignore_above":1024,"type":"keyword"},"DeviceName":{"ignore_above":1024,"type":"keyword"},"DeviceNameLength":{"ignore_above":1024,"type":"keyword"},"DeviceTime":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMajor":{"ignore_above":1024,"type":"keyword"},"DeviceVersionMinor":{"ignore_above":1024,"type":"keyword"},"Direction":{"ignore_above":1024,"type":"keyword"},"DisplayName":{"ignore_above":1024,"type":"keyword"},"DnsHostName":{"ignore_above":1024,"type":"keyword"},"Domain":{"ignore_above":1024,"type":"keyword"},"DomainBehaviorVersion":{"ignore_above":1024,"type":"keyword"},"DomainName":{"ignore_above":1024,"type":"keyword"},"DomainPolicyChanged":{"ignore_above":1024,"type":"keyword"},"DomainSid":{"ignore_above":1024,"type":"keyword"},"DriveName":{"ignore_above":1024,"type":"keyword"},"DriverName":{"ignore_above":1024,"type":"keyword"},"DriverNameLength":{"ignore_above":1024,"type":"keyword"},"Dummy":{"ignore_above":1024,"type":"keyword"},"DwordVal":{"ignore_above":1024,"type":"keyword"},"EnabledPrivilegeList":{"ignore_above":1024,"type":"keyword"},"EnginePID":{"type":"keyword"},"Engine_Version":{"ignore_above":1024,"type":"keyword"},"Engine_up-to-date":{"ignore_above":1024,"type":"keyword"},"Engine_version":{"ignore_above":1024,"type":"keyword"},"EntryCount":{"ignore_above":1024,"type":"keyword"},"ErrorCode":{"ignore_above":1024,"type":"keyword"},"Error_Code":{"ignore_above":1024,"type":"keyword"},"Error_Description":{"ignore_above":1024,"type":"keyword"},"EventCountTotal":{"type":"long"},"EventIdx":{"type":"long"},"EventNamespace":{"ignore_above":1024,"type":"keyword"},"EventSourceId":{"ignore_above":1024,"type":"keyword"},"EventType":{"ignore_above":1024,"type":"keyword"},"Execution_ID":{"ignore_above":1024,"type":"keyword"},"Execution_Name":{"ignore_above":1024,"type":"keyword"},"ExtraInfo":{"ignore_above":1024,"type":"keyword"},"FWLink":{"ignore_above":1024,"type":"keyword"},"FailureName":{"ignore_above":1024,"type":"keyword"},"FailureNameLength":{"ignore_above":1024,"type":"keyword"},"FailureReason":{"ignore_above":1024,"type":"keyword"},"FailureReasons":{"ignore_above":1024,"type":"keyword"},"FailureReasonsOutcome":{"ignore_above":1024,"type":"keyword"},"FileName":{"ignore_above":1024,"type":"keyword"},"FileVersion":{"ignore_above":1024,"type":"keyword"},"FilterId":{"ignore_above":1024,"type":"keyword"},"FilterKey":{"ignore_above":1024,"type":"keyword"},"FilterName":{"ignore_above":1024,"type":"keyword"},"FilterOrigin":{"ignore_above":1024,"type":"keyword"},"FilterRTID":{"ignore_above":1024,"type":"keyword"},"FilterType":{"ignore_above":1024,"type":"keyword"},"FinalStatus":{"ignore_above":1024,"type":"keyword"},"Flags":{"ignore_above":1024,"type":"keyword"},"GPOList":{"ignore_above":1024,"type":"keyword"},"GrantedAccess":{"ignore_above":1024,"type":"keyword"},"Group":{"ignore_above":1024,"type":"keyword"},"GroupMembership":{"ignore_above":1024,"type":"keyword"},"GroupTypeChange":{"ignore_above":1024,"type":"keyword"},"HandleId":{"ignore_above":1024,"type":"keyword"},"HardwareIds":{"ignore_above":1024,"type":"keyword"},"HasRemoteDynamicKeywordAddress":{"ignore_above":1024,"type":"keyword"},"HomeDirectory":{"ignore_above":1024,"type":"keyword"},"HomePath":{"ignore_above":1024,"type":"keyword"},"IOAV_state":{"ignore_above":1024,"type":"keyword"},"Identity":{"ignore_above":1024,"type":"keyword"},"IdleImplementation":{"ignore_above":1024,"type":"keyword"},"IdleStateCount":{"ignore_above":1024,"type":"keyword"},"ImpersonationLevel":{"ignore_above":1024,"type":"keyword"},"IntegrityLevel":{"ignore_above":1024,"type":"keyword"},"InterfaceIndex":{"ignore_above":1024,"type":"keyword"},"IpAddress":{"ignore_above":1024,"type":"keyword"},"IpPort":{"ignore_above":1024,"type":"keyword"},"IsLoopback":{"ignore_above":1024,"type":"keyword"},"KerberosPolicyChange":{"ignore_above":1024,"type":"keyword"},"KeyFilePath":{"ignore_above":1024,"type":"keyword"},"KeyLength":{"ignore_above":1024,"type":"keyword"},"KeyName":{"ignore_above":1024,"type":"keyword"},"KeyType":{"ignore_above":1024,"type":"keyword"},"LastBootGood":{"ignore_above":1024,"type":"keyword"},"LastShutdownGood":{"ignore_above":1024,"type":"keyword"},"Last_AS_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_AV_security_intelligence_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_end_time":{"type":"date"},"Last_full_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_full_scan_start_time":{"type":"date"},"Last_quick_scan_age":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_end_time":{"type":"date"},"Last_quick_scan_source":{"ignore_above":1024,"type":"keyword"},"Last_quick_scan_start_time":{"type":"date"},"Latest_engine_version":{"ignore_above":1024,"type":"keyword"},"Latest_platform_version":{"ignore_above":1024,"type":"keyword"},"LayerId":{"ignore_above":1024,"type":"keyword"},"LayerKey":{"ignore_above":1024,"type":"keyword"},"LayerName":{"ignore_above":1024,"type":"keyword"},"LayerNameDescription":{"ignore_above":1024,"type":"keyword"},"LayerRTID":{"ignore_above":1024,"type":"keyword"},"LinkName":{"ignore_above":1024,"type":"keyword"},"LmPackageName":{"ignore_above":1024,"type":"keyword"},"LocationInformation":{"ignore_above":1024,"type":"keyword"},"LogonGuid":{"ignore_above":1024,"type":"keyword"},"LogonHours":{"ignore_above":1024,"type":"keyword"},"LogonID":{"ignore_above":1024,"type":"keyword"},"LogonId":{"ignore_above":1024,"type":"keyword"},"LogonProcessName":{"ignore_above":1024,"type":"keyword"},"LogonType":{"ignore_above":1024,"type":"keyword"},"MachineAccountQuota":{"ignore_above":1024,"type":"keyword"},"MajorVersion":{"ignore_above":1024,"type":"keyword"},"MandatoryLabel":{"ignore_above":1024,"type":"keyword"},"MasterKeyId":{"ignore_above":1024,"type":"keyword"},"MaximumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MemberName":{"ignore_above":1024,"type":"keyword"},"MemberSid":{"ignore_above":1024,"type":"keyword"},"Mic Status":{"type":"keyword"},"MinimumPerformancePercent":{"ignore_above":1024,"type":"keyword"},"MinimumThrottlePercent":{"ignore_above":1024,"type":"keyword"},"MinorVersion":{"ignore_above":1024,"type":"keyword"},"MixedDomainMode":{"ignore_above":1024,"type":"keyword"},"NRI_engine_version":{"ignore_above":1024,"type":"keyword"},"NRI_security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"Name":{"ignore_above":1024,"type":"keyword"},"NamingContext":{"ignore_above":1024,"type":"keyword"},"NegotiatedFlags":{"type":"keyword"},"NewProcessId":{"ignore_above":1024,"type":"keyword"},"NewProcessName":{"ignore_above":1024,"type":"keyword"},"NewSchemeGuid":{"ignore_above":1024,"type":"keyword"},"NewSd":{"ignore_above":1024,"type":"keyword"},"NewSdDacl0":{"ignore_above":1024,"type":"keyword"},"NewSdDacl1":{"ignore_above":1024,"type":"keyword"},"NewSdDacl2":{"ignore_above":1024,"type":"keyword"},"NewSdSacl0":{"ignore_above":1024,"type":"keyword"},"NewSdSacl1":{"ignore_above":1024,"type":"keyword"},"NewSdSacl2":{"ignore_above":1024,"type":"keyword"},"NewState":{"ignore_above":1024,"type":"keyword"},"NewTargetUserName":{"ignore_above":1024,"type":"keyword"},"NewThreadId":{"ignore_above":1024,"type":"keyword"},"NewTime":{"ignore_above":1024,"type":"keyword"},"NewUACList":{"ignore_above":1024,"type":"keyword"},"NewUacValue":{"ignore_above":1024,"type":"keyword"},"NominalFrequency":{"ignore_above":1024,"type":"keyword"},"NtlmVersion":{"type":"keyword"},"Number":{"ignore_above":1024,"type":"keyword"},"OA_state":{"ignore_above":1024,"type":"keyword"},"ObjectClass":{"ignore_above":1024,"type":"keyword"},"ObjectDN":{"ignore_above":1024,"type":"keyword"},"ObjectGUID":{"ignore_above":1024,"type":"keyword"},"ObjectName":{"ignore_above":1024,"type":"keyword"},"ObjectServer":{"ignore_above":1024,"type":"keyword"},"ObjectType":{"ignore_above":1024,"type":"keyword"},"OemInformation":{"ignore_above":1024,"type":"keyword"},"OldSchemeGuid":{"ignore_above":1024,"type":"keyword"},"OldSd":{"ignore_above":1024,"type":"keyword"},"OldSdDacl0":{"ignore_above":1024,"type":"keyword"},"OldSdDacl1":{"ignore_above":1024,"type":"keyword"},"OldSdDacl2":{"ignore_above":1024,"type":"keyword"},"OldSdSacl0":{"ignore_above":1024,"type":"keyword"},"OldSdSacl1":{"ignore_above":1024,"type":"keyword"},"OldSdSacl2":{"ignore_above":1024,"type":"keyword"},"OldTargetUserName":{"ignore_above":1024,"type":"keyword"},"OldTime":{"ignore_above":1024,"type":"keyword"},"OldUacValue":{"ignore_above":1024,"type":"keyword"},"OpCorrelationID":{"ignore_above":1024,"type":"keyword"},"Operation":{"ignore_above":1024,"type":"keyword"},"OperationType":{"ignore_above":1024,"type":"keyword"},"Options":{"type":"long"},"Origin_ID":{"ignore_above":1024,"type":"keyword"},"Origin_Name":{"ignore_above":1024,"type":"keyword"},"OriginalFileName":{"ignore_above":1024,"type":"keyword"},"OriginalProfile":{"ignore_above":1024,"type":"keyword"},"PackageName":{"ignore_above":1024,"type":"keyword"},"ParentProcessName":{"ignore_above":1024,"type":"keyword"},"PasswordHistoryLength":{"ignore_above":1024,"type":"keyword"},"PasswordLastSet":{"ignore_above":1024,"type":"keyword"},"Path":{"ignore_above":1024,"type":"keyword"},"PerformanceImplementation":{"ignore_above":1024,"type":"keyword"},"Platform_up-to-date":{"ignore_above":1024,"type":"keyword"},"Platform_version":{"ignore_above":1024,"type":"keyword"},"Post_Clean_Status":{"ignore_above":1024,"type":"keyword"},"PreAuthType":{"ignore_above":1024,"type":"keyword"},"Pre_Execution_Status":{"ignore_above":1024,"type":"keyword"},"PreviousCreationUtcTime":{"ignore_above":1024,"type":"keyword"},"PreviousTime":{"ignore_above":1024,"type":"keyword"},"Previous_Engine_Version":{"ignore_above":1024,"type":"keyword"},"Previous_security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"PrimaryGroupId":{"ignore_above":1024,"type":"keyword"},"Priority":{"type":"keyword"},"PrivilegeList":{"ignore_above":1024,"type":"keyword"},"ProcessCreationTime":{"ignore_above":1024,"type":"keyword"},"ProcessID":{"ignore_above":1024,"type":"keyword"},"ProcessId":{"ignore_above":1024,"type":"keyword"},"ProcessName":{"ignore_above":1024,"type":"keyword"},"ProcessPID":{"type":"keyword"},"ProcessPath":{"ignore_above":1024,"type":"keyword"},"ProcessPid":{"ignore_above":1024,"type":"keyword"},"Product":{"ignore_above":1024,"type":"keyword"},"Product_Name":{"ignore_above":1024,"type":"keyword"},"Product_Version":{"ignore_above":1024,"type":"keyword"},"Product_status":{"ignore_above":1024,"type":"keyword"},"Profile":{"ignore_above":1024,"type":"keyword"},"ProfileChanged":{"ignore_above":1024,"type":"keyword"},"ProfilePath":{"ignore_above":1024,"type":"keyword"},"ProfileUsed":{"ignore_above":1024,"type":"keyword"},"Properties":{"ignore_above":1024,"type":"keyword"},"ProtectedDataFlags":{"ignore_above":1024,"type":"keyword"},"Protocol":{"ignore_above":1024,"type":"keyword"},"ProviderContextKey":{"ignore_above":1024,"type":"keyword"},"ProviderContextName":{"ignore_above":1024,"type":"keyword"},"ProviderContextType":{"ignore_above":1024,"type":"keyword"},"ProviderKey":{"ignore_above":1024,"type":"keyword"},"ProviderName":{"ignore_above":1024,"type":"keyword"},"PuaCount":{"ignore_above":1024,"type":"keyword"},"PuaPolicyId":{"ignore_above":1024,"type":"keyword"},"QfeVersion":{"ignore_above":1024,"type":"keyword"},"Query":{"ignore_above":1024,"type":"keyword"},"RTP_state":{"ignore_above":1024,"type":"keyword"},"ReadOperation":{"ignore_above":1024,"type":"keyword"},"Reason":{"ignore_above":1024,"type":"keyword"},"ReasonForRejection":{"ignore_above":1024,"type":"keyword"},"RecoveryKeyId":{"ignore_above":1024,"type":"keyword"},"RecoveryServer":{"ignore_above":1024,"type":"keyword"},"RelativeTargetName":{"ignore_above":1024,"type":"keyword"},"Remediation_User":{"ignore_above":1024,"type":"keyword"},"RemoteAddress_ip":{"type":"ip"},"RemoteAddress_name":{"ignore_above":1024,"type":"keyword"},"RemoteClientMachine":{"type":"keyword"},"RemoteCredentialGuard":{"ignore_above":1024,"type":"keyword"},"RemoteMachineDescription":{"ignore_above":1024,"type":"keyword"},"RemoteMachineID":{"ignore_above":1024,"type":"keyword"},"RemoteUserDescription":{"ignore_above":1024,"type":"keyword"},"RemoteUserID":{"ignore_above":1024,"type":"keyword"},"RequestId":{"ignore_above":1024,"type":"keyword"},"Resource":{"ignore_above":1024,"type":"keyword"},"ResourceAttributes":{"ignore_above":1024,"type":"keyword"},"ResourceManager":{"ignore_above":1024,"type":"keyword"},"ResultCode":{"type":"keyword"},"ReturnCode":{"ignore_above":1024,"type":"keyword"},"ReturnCodeOutcome":{"ignore_above":1024,"type":"keyword"},"RuleAttr":{"ignore_above":1024,"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"SID":{"ignore_above":1024,"type":"keyword"},"SPI":{"ignore_above":1024,"type":"keyword"},"SamAccountName":{"ignore_above":1024,"type":"keyword"},"Scan_ID":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters":{"ignore_above":1024,"type":"keyword"},"Scan_Parameters_Index":{"ignore_above":1024,"type":"keyword"},"Scan_Type":{"ignore_above":1024,"type":"keyword"},"Scan_Type_Index":{"ignore_above":1024,"type":"keyword"},"Schema":{"ignore_above":1024,"type":"keyword"},"SchemaFriendlyName":{"ignore_above":1024,"type":"keyword"},"SchemaVersion":{"ignore_above":1024,"type":"keyword"},"ScriptBlockText":{"ignore_above":1024,"type":"keyword"},"ScriptPath":{"ignore_above":1024,"type":"keyword"},"SearchString":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Type_Index":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_Version":{"ignore_above":1024,"type":"keyword"},"Security_intelligence_version":{"ignore_above":1024,"type":"keyword"},"ServerDomain":{"type":"keyword"},"ServerIP":{"type":"keyword"},"ServerName":{"type":"keyword"},"ServerOS":{"type":"keyword"},"Service":{"ignore_above":1024,"type":"keyword"},"ServiceAccount":{"ignore_above":1024,"type":"keyword"},"ServiceBinding":{"type":"keyword"},"ServiceFileName":{"ignore_above":1024,"type":"keyword"},"ServiceName":{"ignore_above":1024,"type":"keyword"},"ServicePrincipalNames":{"ignore_above":1024,"type":"keyword"},"ServiceSid":{"ignore_above":1024,"type":"keyword"},"ServiceStartType":{"ignore_above":1024,"type":"keyword"},"ServiceType":{"ignore_above":1024,"type":"keyword"},"ServiceVersion":{"ignore_above":1024,"type":"keyword"},"Session":{"ignore_above":1024,"type":"keyword"},"SessionId":{"ignore_above":1024,"type":"keyword"},"SessionKeyStatus":{"type":"keyword"},"SessionName":{"ignore_above":1024,"type":"keyword"},"Severity_ID":{"ignore_above":1024,"type":"keyword"},"Severity_Name":{"ignore_above":1024,"type":"keyword"},"ShareLocalPath":{"ignore_above":1024,"type":"keyword"},"ShareName":{"ignore_above":1024,"type":"keyword"},"ShutdownActionType":{"ignore_above":1024,"type":"keyword"},"ShutdownEventCode":{"ignore_above":1024,"type":"keyword"},"ShutdownReason":{"ignore_above":1024,"type":"keyword"},"SidFilteringEnabled":{"ignore_above":1024,"type":"keyword"},"SidHistory":{"ignore_above":1024,"type":"keyword"},"Signature":{"ignore_above":1024,"type":"keyword"},"SignatureStatus":{"ignore_above":1024,"type":"keyword"},"Signed":{"ignore_above":1024,"type":"keyword"},"SourceAddress":{"ignore_above":1024,"type":"keyword"},"SourcePort":{"ignore_above":1024,"type":"keyword"},"Source_ID":{"ignore_above":1024,"type":"keyword"},"Source_Name":{"ignore_above":1024,"type":"keyword"},"StartAddress":{"ignore_above":1024,"type":"keyword"},"StartFunction":{"ignore_above":1024,"type":"keyword"},"StartModule":{"ignore_above":1024,"type":"keyword"},"StartTime":{"ignore_above":1024,"type":"keyword"},"StartUSN":{"type":"long"},"State":{"ignore_above":1024,"type":"keyword"},"Status":{"ignore_above":1024,"type":"keyword"},"StatusCode":{"type":"long"},"StatusDescription":{"ignore_above":1024,"type":"keyword"},"StatusMsg":{"type":"keyword"},"Status_Code":{"ignore_above":1024,"type":"keyword"},"StopTime":{"ignore_above":1024,"type":"keyword"},"SubCategory":{"ignore_above":1024,"type":"keyword"},"SubCategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubCategoryId":{"ignore_above":1024,"type":"keyword"},"SubStatus":{"ignore_above":1024,"type":"keyword"},"SubcategoryGuid":{"ignore_above":1024,"type":"keyword"},"SubcategoryId":{"ignore_above":1024,"type":"keyword"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TSId":{"ignore_above":1024,"type":"keyword"},"TargetDomain":{"type":"keyword"},"TargetDomainName":{"ignore_above":1024,"type":"keyword"},"TargetImage":{"ignore_above":1024,"type":"keyword"},"TargetInfo":{"ignore_above":1024,"type":"keyword"},"TargetLinkedLogonId":{"ignore_above":1024,"type":"keyword"},"TargetLogonGuid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetMachine":{"type":"keyword"},"TargetName":{"ignore_above":1024,"type":"keyword"},"TargetProcessGUID":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"ignore_above":1024,"type":"keyword"},"TargetServerName":{"ignore_above":1024,"type":"keyword"},"TargetSid":{"ignore_above":1024,"type":"keyword"},"TargetUserName":{"ignore_above":1024,"type":"keyword"},"TargetUserSid":{"ignore_above":1024,"type":"keyword"},"TaskContent":{"ignore_above":1024,"type":"keyword"},"TaskContentNew":{"ignore_above":1024,"type":"keyword"},"TaskInstanceId":{"type":"keyword"},"TaskName":{"ignore_above":1024,"type":"keyword"},"TdoAttributes":{"ignore_above":1024,"type":"keyword"},"TdoDirection":{"ignore_above":1024,"type":"keyword"},"TdoSid":{"ignore_above":1024,"type":"keyword"},"TdoType":{"ignore_above":1024,"type":"keyword"},"TerminalSessionId":{"ignore_above":1024,"type":"keyword"},"Threat_ID":{"ignore_above":1024,"type":"keyword"},"Threat_Name":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionType":{"ignore_above":1024,"type":"keyword"},"TicketEncryptionTypeDescription":{"ignore_above":1024,"type":"keyword"},"TicketOptions":{"ignore_above":1024,"type":"keyword"},"TicketOptionsDescription":{"ignore_above":1024,"type":"keyword"},"TokenElevationType":{"ignore_above":1024,"type":"keyword"},"TransactionId":{"ignore_above":1024,"type":"keyword"},"TransmittedServices":{"ignore_above":1024,"type":"keyword"},"TreeDelete":{"ignore_above":1024,"type":"keyword"},"Type":{"ignore_above":1024,"type":"keyword"},"Type_ID":{"ignore_above":1024,"type":"keyword"},"Type_Name":{"ignore_above":1024,"type":"keyword"},"Update_Type":{"ignore_above":1024,"type":"keyword"},"Update_Type_Index":{"ignore_above":1024,"type":"keyword"},"User":{"ignore_above":1024,"type":"keyword"},"UserAccountControl":{"ignore_above":1024,"type":"keyword"},"UserContext":{"type":"keyword"},"UserName":{"ignore_above":1024,"type":"keyword"},"UserParameters":{"ignore_above":1024,"type":"keyword"},"UserPrincipalName":{"ignore_above":1024,"type":"keyword"},"UserSid":{"ignore_above":1024,"type":"keyword"},"UserWorkstations":{"ignore_above":1024,"type":"keyword"},"Username":{"type":"keyword"},"VendorIds":{"ignore_above":1024,"type":"keyword"},"Version":{"ignore_above":1024,"type":"keyword"},"Weight":{"ignore_above":1024,"type":"keyword"},"Workstation":{"ignore_above":1024,"type":"keyword"},"WorkstationName":{"ignore_above":1024,"type":"keyword"},"param1":{"ignore_above":1024,"type":"keyword"},"param2":{"ignore_above":1024,"type":"keyword"},"param3":{"ignore_above":1024,"type":"keyword"},"param4":{"ignore_above":1024,"type":"keyword"},"param5":{"ignore_above":1024,"type":"keyword"},"param6":{"ignore_above":1024,"type":"keyword"},"param7":{"ignore_above":1024,"type":"keyword"},"param8":{"ignore_above":1024,"type":"keyword"}}},"event_id":{"ignore_above":1024,"type":"keyword"},"keywords":{"ignore_above":1024,"type":"keyword"},"level":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"failure":{"properties":{"reason":{"ignore_above":1024,"type":"keyword"},"status":{"ignore_above":1024,"type":"keyword"},"sub_status":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"opcode":{"ignore_above":1024,"type":"keyword"},"outcome":{"ignore_above":1024,"type":"keyword"},"process":{"properties":{"pid":{"type":"long"},"thread":{"properties":{"id":{"type":"long"}}}}},"provider_guid":{"ignore_above":1024,"type":"keyword"},"provider_name":{"ignore_above":1024,"type":"keyword"},"record_id":{"ignore_above":1024,"type":"keyword"},"related_activity_id":{"ignore_above":1024,"type":"keyword"},"scheduled_task":{"properties":{"actions":{"properties":{"arguments":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"class_id":{"ignore_above":1024,"type":"keyword"},"command":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"},"context":{"ignore_above":1024,"type":"keyword"},"definition":{"type":"wildcard"},"type":{"ignore_above":1024,"type":"keyword"},"working_directory":{"fields":{"text":{"type":"match_only_text"}},"ignore_above":4096,"type":"wildcard"}}},"name":{"ignore_above":4096,"type":"keyword"},"principals":{"properties":{"group":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}},"id":{"ignore_above":1024,"type":"keyword"},"logon":{"properties":{"type":{"ignore_above":1024,"type":"keyword"}}},"run_level":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"identifier":{"ignore_above":1024,"type":"keyword"}}}}},"settings":{"properties":{"enabled":{"type":"boolean"},"hidden":{"type":"boolean"}}},"triggers":{"properties":{"definition":{"type":"wildcard"},"enabled":{"type":"boolean"},"repetition":{"properties":{"duration":{"ignore_above":1024,"type":"keyword"},"interval":{"ignore_above":1024,"type":"keyword"},"stop_at_duration_end":{"type":"boolean"}}},"type":{"ignore_above":1024,"type":"keyword"}}},"uri":{"ignore_above":4096,"type":"keyword"}}},"task":{"ignore_above":1024,"type":"keyword"},"time_created":{"type":"date"},"trustAttribute":{"ignore_above":1024,"type":"keyword"},"trustDirection":{"ignore_above":1024,"type":"keyword"},"trustType":{"ignore_above":1024,"type":"keyword"},"user":{"properties":{"domain":{"ignore_above":1024,"type":"keyword"},"identifier":{"ignore_above":1024,"type":"keyword"},"name":{"ignore_above":1024,"type":"keyword"},"type":{"ignore_above":1024,"type":"keyword"}}},"user_data":{"dynamic":"true","properties":{"BackupPath":{"ignore_above":1024,"type":"keyword"},"CONSUMER":{"type":"keyword"},"Channel":{"ignore_above":1024,"type":"keyword"},"ClientMachine":{"type":"keyword"},"ClientProcessId":{"type":"keyword"},"Code":{"type":"keyword"},"Component":{"type":"keyword"},"ESS":{"type":"keyword"},"FileHash":{"ignore_above":1024,"type":"keyword"},"FileHashLength":{"type":"long"},"FilePath":{"ignore_above":1024,"type":"keyword"},"FilePathLength":{"type":"long"},"Fqbn":{"ignore_above":1024,"type":"keyword"},"FqbnLength":{"type":"long"},"FullFilePath":{"ignore_above":1024,"type":"keyword"},"FullFilePathLength":{"type":"long"},"HostProcess":{"type":"keyword"},"Id":{"type":"keyword"},"Namespace":{"type":"keyword"},"NamespaceName":{"type":"keyword"},"Operation":{"type":"keyword"},"PolicyName":{"ignore_above":1024,"type":"keyword"},"PolicyNameLength":{"type":"long"},"PossibleCause":{"type":"keyword"},"ProcessID":{"type":"keyword"},"Processid":{"type":"keyword"},"Provider":{"type":"keyword"},"ProviderName":{"type":"keyword"},"ProviderPath":{"type":"keyword"},"Query":{"type":"keyword"},"ResultCode":{"type":"keyword"},"RuleId":{"ignore_above":1024,"type":"keyword"},"RuleName":{"ignore_above":1024,"type":"keyword"},"RuleNameLength":{"type":"long"},"RuleSddl":{"ignore_above":1024,"type":"keyword"},"RuleSddlLength":{"type":"long"},"SubjectDomainName":{"ignore_above":1024,"type":"keyword"},"SubjectLogonId":{"ignore_above":1024,"type":"keyword"},"SubjectUserName":{"ignore_above":1024,"type":"keyword"},"SubjectUserSid":{"ignore_above":1024,"type":"keyword"},"TargetLogonId":{"ignore_above":1024,"type":"keyword"},"TargetProcessId":{"type":"long"},"TargetUser":{"ignore_above":1024,"type":"keyword"},"User":{"type":"keyword"},"queryid":{"type":"keyword"},"xml_name":{"ignore_above":1024,"type":"keyword"}}},"version":{"type":"long"}}}}},"settings":{"analysis":{"analyzer":{"powershell_script_analyzer":{"pattern":"[\\W&&[^-]]+","type":"pattern"}}},"mapping":{"total_fields":{"limit":"20000"}},"number_of_replicas":0,"number_of_shards":1}}],"schema":"native-ctf-portable-indices/v1","source_elasticsearch_version":"9.4.2"}