ECS Categorization Field: event.kind
editECS Categorization Field: event.kind
editThis is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
event.kind
gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.
After the beta period for categorization, only the allowed categorization values listed in the ECS repository and official ECS documentation should be considered official. Use of any other values may result in incompatible implementations that will require subsequent breaking changes.
Allowed Values
alert
editThis value indicates an event that describes an alert or notable event, triggered by a detection rule.
event.kind:alert
is often populated for events coming from firewalls, intrusion detection systems, endpoint detection and response systems, and so on.
event
editThis value is the most general and most common value for this field. It is used to represent events that indicate that something happened.
metric
editThis value is used to indicate that this event describes a numeric measurement taken at given point in time.
Examples include CPU utilization, memory usage, or device temperature.
Metric events are often collected on a predictable frequency, such as once every few seconds, or once a minute, but can also be used to describe ad-hoc numeric metric queries.
state
editThe state value is similar to metric, indicating that this event describes a measurement taken at given point in time, except that the measurement does not result in a numeric value, but rather one of a fixed set of categorical values that represent conditions or states.
Examples include periodic events reporting Elasticsearch cluster state (green/yellow/red), the state of a TCP connection (open, closed, fin_wait, etc.), the state of a host with respect to a software vulnerability (vulnerable, not vulnerable), and the state of a system regarding compliance with a regulatory standard (compliant, not compliant).
Note that an event that describes a change of state would not use event.kind:state
, but instead would use event.kind:event since a state change fits the more general event definition of something that happened.
State events are often collected on a predictable frequency, such as once every few seconds, once a minute, once an hour, or once a day, but can also be used to describe ad-hoc state queries.
pipeline_error
editThis value indicates that an error occurred during the ingestion of this event, and that event data may be missing, inconsistent, or incorrect. event.kind:pipeline_error
is often associated with parsing errors.
signal
editThis value is used by the Elastic SIEM app to denote an Elasticsearch document that was created by a SIEM detection engine rule.
A signal will typically trigger a notification that something meaningful happened and should be investigated.
Usage of this value is reserved, and pipelines should not populate event.kind
with the value "signal".