Zeek fields

A unique identifier of the session

type: keyword

Indicates whether the session is originated locally

type: boolean

Indicates whether the session is responded locally

type: boolean

Missed bytes for the session

type: long

Flags indicating the state of the session

type: keyword

Flags indicating the history of the session

type: keyword

Link-layer address of the originator, if available

type: keyword

Link-layer address of the responder, if available

type: keyword

VLAN identifier

type: integer

VLAN identifier

type: integer

DNS transaction identifier

type: keyword

Round trip time for the query and response

type: double

The domain name that is the subject of the DNS query

type: keyword

The QCLASS value specifying the class of the query

type: long

A descriptive name for the class of the query

type: keyword

A QTYPE value specifying the type of the query

type: long

A descriptive name for the type of the query

type: keyword

The response code value in DNS response messages

type: long

A descriptive name for the response code value

type: keyword

The Authoritative Answer bit for response messages specifies that the responding name server is an authority for the domain name in the question section

type: boolean

The Truncation bit specifies that the message was truncated

type: boolean

The Recursion Desired bit in a request message indicates that the client wants recursive service for this query

type: boolean

The Recursion Available bit in a response message indicates that the name server supports recursive queries.

type: boolean

The set of resource descriptions in the query answer

type: keyword

The caching intervals of the associated RRs described by the answers field

type: double

Indicates whether the DNS query was rejected by the server

type: boolean

The total number of resource records in the reply

type: integer

The total number of resource records in the reply message

type: integer

Whether the full DNS query has been seen

type: boolean

Whether the full DNS reply has been seen

type: boolean

Represents the pipelined depth into the connection of this request/response transaction

type: integer

Status message returned by the server

type: keyword

Last seen 1xx informational reply code returned by the server.

type: integer

Last seen 1xx informational reply message returned by the server.

type: keyword

A set of indicators of various attributes discovered and related to a particular request/response pair.

type: keyword

Password if basic-auth is performed for the request

type: keyword

Determines if the password will be captured for this request

type: boolean

All of the headers that may indicate if the HTTP request was proxied

type: keyword

Indicates if this request can assume 206 partial content in response

type: boolean

The vector of HTTP header names sent by the client. No header values are included here, just the header names.

type: keyword

The vector of HTTP header names sent by the server. No header values are included here, just the header names

type: keyword

An ordered vector of file unique IDs from the originator

type: keyword

An ordered vector of mime types from the originator

type: keyword

An ordered vector of filenames from the originator

type: keyword

An ordered vector of file unique IDs from the responder

type: keyword

An ordered vector of mime types from the responder

type: keyword

An ordered vector of filenames from the responder

type: keyword

Current number of MIME entities in the HTTP request message body

type: integer

Current number of MIME entities in the HTTP response message body

type: integer

A file unique identifier

type: keyword

The host that transferred the file

type: ip

The host that received the file

type: ip

The sessions that have this file

type: keyword

An identification of the source of the file data. E.g. it may be a network protocol over which it was transferred, or a local file path which was read, or some other input source

type: keyword

A value to represent the depth of this file in relation to its source. In SMTP, it is the depth of the MIME attachment on the message. In HTTP, it is the depth of the request within the TCP connection

type: long

A set of analysis types done during the file analysis

type: keyword

Mime type of the file

type: keyword

Name of the file if available

type: keyword

If the source of this file is a network connection, this field indicates if the data originated from the local network or not

type: boolean

If the source of this file is a network connection, this field indicates if the file is being sent by the originator of the connection or the responder

type: boolean

The duration the file was analyzed for. Not the duration of the session.

type: double

Number of bytes provided to the file analysis engine for the file

type: long

Total number of bytes that are supposed to comprise the full file

type: long

The number of bytes in the file stream that were completely missed during the process of analysis

type: long

The number of bytes in the file stream that were not delivered to stream file analyzers. This could be overlapping bytes or bytes that couldn’t be reassembled

type: long

Whether the file analysis timed out at least once for the file

type: boolean

Identifier associated with a container file from which this one was extracted as part of the file analysis

type: keyword

An MD5 digest of the file contents

type: keyword

A SHA1 digest of the file contents

type: keyword

A SHA256 digest of the file contents.

type: keyword

Local filename of extracted file

type: keyword

Indicate whether the file being extracted was cut off hence not extracted completely

type: boolean

The number of bytes extracted to disk

type: long

The information density of the contents of the file

type: double

SSL/TLS version that was logged

type: keyword

SSL/TLS cipher suite that was logged

type: keyword

Elliptic curve that was logged when using ECDH/ECDHE

type: keyword

Value of the Server Name Indicator SSL/TLS extension. It indicates the server name that the client was requesting

type: keyword

Flag to indicate if the session was resumed reusing the key material exchanged in an earlier connection

type: boolean

Next protocol the server chose using the application layer next protocol extension

type: keyword

Flag to indicate if this ssl session has been established successfully

type: boolean

Chain of certificates offered by the server to validate its complete signing chain

type: keyword

An ordered vector of certificate file identifiers for the certificates offered by the server

type: keyword

Chain of certificates offered by the client to validate its complete signing chain

type: keyword

An ordered vector of certificate file identifiers for the certificates offered by the client

type: keyword

Subject of the signer of the X.509 certificate offered by the server

type: keyword

Subject of the X.509 certificate offered by the client

type: keyword

Result of certificate validation for this connection

type: keyword

Result of certificate validation for this connection, given as OpenSSL validation code

type: keyword

Subject of the X.509 certificate offered by the server

type: keyword

Subject of the X.509 certificate offered by the client

type: keyword

Last alert that was seen during the connection

type: keyword

Identifier of the related connection session

type: keyword

Identifier of the related ICMP session

type: keyword

An identifier associated with a single file that is related to this notice

type: keyword

Identifier associated with a container file from which this one was extracted

type: keyword

An identification of the source of the file data. E.g. it may be a network protocol over which it was transferred, or a local file path which was read, or some other input source

type: keyword

A mime type if the notice is related to a file

type: keyword

If the source of this file is a network connection, this field indicates if the file is being sent by the originator of the connection or the responder

type: boolean

Number of bytes provided to the file analysis engine for the file

type: long

Total number of bytes that are supposed to comprise the full file

type: long

The number of bytes in the file stream that were completely missed during the process of analysis

type: long

The number of bytes in the file stream that were not delivered to stream file analyzers. This could be overlapping bytes or bytes that couldn’t be reassembled

type: long

A file unique ID if this notice is related to a file

type: keyword

The type of the notice

type: keyword

The human readable message for the notice.

type: keyword

The human readable sub-message

type: keyword

Associated count, or a status code

type: long

Name of remote peer that raised this notice

type: keyword

Textual description for the peer that raised this notice

type: text

The actions which have been applied to this notice

type: keyword

By adding chunks of text into this element, other scripts can expand on notices that are being emailed

type: text

Adding a string token to this set will cause the built-in emailing functionality to delay sending the email either the token has been removed or the email has been delayed for the specified time duration

type: keyword

This field is provided when a notice is generated for the purpose of deduplicating notices

type: keyword

This field indicates the length of time that this unique notice should be suppressed

type: double

Indicate if the source IP address was dropped and denied network access

type: boolean