Understanding the Schema for Events
The following table describes the columns of the default_sec_ops_adm.Events table:
| Column Name | Data Type | Description |
|---|---|---|
| agentAddressBin/agentAddress | Binary(16) | The IP address of the ArcSight connector that processed the event. |
| agentHostName | Varchar(1023) | The hostname of the ArcSight connector that processed the event. |
| agentNtDomain | Varchar(255) | |
| agentSeverity | Varchar(9) | |
| agentType | Varchar(63) | The agent type of the ArcSight connector that processed the event. |
| agentZoneURI | Varchar(2048) | Specify hourly, daily, weekly, or monthly. |
| applicationProtocol | Varchar(40) | Application level protocol, example values are HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on. |
| baseEventCount | Integer | A count associated with this event. How many times was this same event observed? Count can be omitted if it is 1. |
| bytesIn | Integer | Number of bytes transferred inbound, relative to the source to destination relationship, meaning that data was flowing from source to destination. |
| bytesOut | Integer | Number of bytes transferred outbound relative to the source to destination relationship. For example, the byte number of data flowing from the destination to the source. |
| categoryBehavior | Varchar(1023) | The action or behavior associated with the event. |
| categoryDeviceGroup | Varchar(1023) | The type of events for the device. |
| categoryObject | Varchar(1023) | The type of the object. |
| categoryOutcome | Varchar(1023) | The outcome of the event. |
| categorySignificance | Varchar(1023) | The significance of the event. |
| categoryTechnique | Varchar(1023) | |
| destinationAddressBin/destinationAddress | Binary(16) | Identifies the destination address that the event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1” |
| destinationDnsDomain | Varchar(255) | The DNS domain part of the complete fully qualified domain name (FQDN). |
| destinationHostName | Varchar(1023) | Identifies the destination that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the destination node, when a node is available. Examples: “host.domain.com” or “host”. |
| destinationMacAddressBin/ destinationMacAddress | Binary(16) | Six colon-seperated hexadecimal numbers. Example: “00:0D:60:AF:1B:61” |
| destinationNtDomain | Varchar(255) | The Windows domain name of the destination address. |
| destinationPort | Integer | The valid port numbers are between 0 and 65535. |
| destinationProcessName | Varchar(1023) | The name of the event’s destination process. Example: “telnetd” or “sshd”. |
| destinationServiceName | Varchar(1023) | The service targeted by this event. Example: “sshd” |
| destinationTranslatedAddressBin/ destinationTranslatedAddress | Binary(16) | |
| destinationUserId | Varchar(1023) | Identifies the destination user by ID. For example, in UNIX, the root user is generally associated with user ID 0. |
| destinationUserName | Varchar(1023) | Identifies the destination user by name. This is the user associated with the event’s destination. Email addresses are often mapped into the UserName fields. The recipient is a candidate to put into this field. |
| destinationUserPrivileges | Varchar(1023) | The typical values are “Administrator”, “User”, and “Guest”. This identifies the destination user’s privileges. In UNIX, for example, activity executed on the root user would be identified with destinationUser Privileges of “Administrator”. |
| destinationZoneURI | Varchar(2048) | The URI for the Zone that the destination asset has been assigned to in ArcSight. |
| deviceAction | Varchar(63) | Action taken by the device. |
| deviceAddressBin/deviceAddress | Binary(16) | Identifies the device address that an event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1”. |
| deviceCustomDate1 | Integer | One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomDate1Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomDate2 | Integer | One of two timestamp fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomDate2Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomNumber1 | Integer | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomNumber1Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomNumber2 | Integer | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomNumber2Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomNumber3 | Integer | One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomNumber3Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString1 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString1Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString2 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString2Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString3 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString3Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString4 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString4Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString5 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString5Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomString6 | Varchar(4000) | One of six strings available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. |
| deviceCustomString6Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceEventCategory | Varchar(1023) | Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. Example: “/Monitor/Disk/Read” |
| deviceEventClassId | Varchar(100) | Unique code assigned to an event. |
| deviceExternalId | Varchar(255) | A name that uniquely identifies the device generating this event. |
| deviceHostName | Varchar(100) | The format should be a fully qualified domain name (FQDN) associated with the device node, when a node is available. Example: “host.domain.com” or “host”. |
| deviceInboundInterface | Varchar(128) | Interface on which the packet or data entered the device. |
| deviceOutboundInterface | Varchar(128) | Interface on which the packet or data left the device. |
| deviceProduct | Varchar(100) | The device product of the client. |
| deviceReceiptTime | Integer | The time at which the event related to the activity was received. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970) |
| deviceSeverity | Varchar(63) | The HTTP response status. |
| deviceVendor | Varchar(100) | The device vendor of the client. |
| deviceVersion | Varchar(31) | The device version. |
| deviceZoneURI | Varchar(2048) | The URI for the Zone that the device asset has been assigned to in ArcSight. |
| endTime | Integer | The time at which the activity related to the event ended. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st1970). An example would be reporting the end of a session. |
| eventId | Integer | This is a unique ID that ArcSight assigns to each event. |
| externalId | Varchar(40) | The ID used by an originating device. They are usually increasing numbers, associated with events. |
| fileName | Varchar(1023) | Name of the file only (without its path). |
| filePath | Varchar(1023) | Full path to the old file, including the file name itself. Examples: c:\Program Files\ WindowsNT\Accessories \wordpad.exe or /usr/bin/zip |
| flexDate1 | Integer | A timestamp field available to map a timestamp that does not apply to any other defined timestamp field in this dictionary. Use all flex fields sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary. |
| flexDate1Label | Varchar(128) | The label field is a string and describes the purpose of the flex field. |
| flexNumber1 | Integer | |
| flexNumber1Label | Varchar(128) | |
| flexNumber2 | Integer | |
| flexNumber2Label | Varchar(128) | |
| flexString1 | Varchar(1023) | One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary. |
| flexString1Label | Varchar(128) | The label field is a string and describes the purpose of the flex field. |
| flexString2 | Varchar(1023) | One of four floating point fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible. These fields are typically reserved for customer use and should not be set by vendors unless necessary. |
| flexString2Label | Varchar(128) | The label field is a string and describes the purpose of the flex field. |
| globalEventId | Integer | |
| message | Varchar(1023) | An arbitrary message giving more details about the event. Multi-line entries can be produced by using \n as the new line separator. |
| name | Varchar(1023) | |
| requestClientApplication | Varchar(1023) | The User-Agent associated with the request. |
| requestContext | Varchar(2048) | Description of the content from which the request originated (for example, HTTP Referrer) |
| requestMethod | Varchar(1023) | The method used to access a URL. Possible values: “POST”, “GET”, etc. |
| requestUrl | Varchar(2048) | In the case of an HTTP request, this field contains the URL accessed. The URL should contain the protocol as well. Example: “http://www/secure.com” |
| requestUrlFileName | Varchar(2048) | |
| requestUrlQuery | Varchar(2048) | |
| sourceAddressBin/sourceAddress | Binary(16) | Identifies the source that an event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1”. |
| sourceHostName | Varchar(1023) | Identifies the source that an event refers to in an IP network. The format should be a fully qualified domain name (FQDN) associated with the source node, when a mode is available. Examples: “host” or “host.domain.com”. |
| sourceMacAddressBin/sourceMacAddress | Binary(16) | Six colon-separated hexadecimal numbers. Example: “00:0D:60:AF:1B:61” |
| sourceNtDomain | Varchar(255) | The Windows domain name for the source address. |
| sourcePort | Integer | The valid port numbers are 0 to 65535. |
| sourceProcessName | Varchar(1023) | The name of the event’s source process. |
| sourceServiceName | Varchar(1023) | The service that is responsible for generating this event. |
| sourceTranslatedAddressBin/sourceTranslatedAddress | Binary(16) | Identifies the translated source that the event refers to in an IP network. The format is an IPv4 address. Example: “192.168.10.1”. |
| sourceUserId | Varchar(1023) | Identifies the source user by ID. This is the user associated with the source of the event. For example, in UNIX, the root user is generally associated with user ID 0. |
| sourceUserName | Varchar(1023) | Identifies the source user by name. Email addresses are also mapped into the UserName fields. The sender is a candidate to put into this field. |
| sourceUserPrivileges | Varchar(1023) | The typical values are “Administrator”, “User”, and “Guest”. It identifies the source user’s privileges. In UNIX, for example, activity executed by the root user would be identified with “Administrator”. |
| sourceZoneURI | Varchar(2048) | The URI for the Zone that the source asset has been assigned to in ArcSight. |
| startTime | Integer | The time when the activity the event referred to started. The format is MMM dd yyyy HH:mm:ss or milliseconds since epoch (Jan 1st 1970) |
| transportProtocol | Varchar(31) | Identifies the Layer-4 protocol used. The possible values are protocols such as TCP or UDP. |
| type | Varchar(1023) | 0 means base event, 1 means aggregated, 2 means correlation, and 3 means action. This field can be omitted for base events (type 0). |
| agentDnsDomain | Varchar(255) | The DNS domain name of the ArcSight connector that processed the event. |
| agentId | Varchar(40) | The agent ID of the ArcSight connector that processed the event. |
| agentMacAddressBin | Binary(16) | |
| agentReceiptTime | Integer | The time at which information about the event was received by the ArcSight connector. |
| agentTimeZone | Varchar(255) | The agent time zone of the ArcSight connector that processed the event. |
| agentTranslatedAddressBin | Binary(16) | |
| agentTranslatedZoneExternalID | Varchar(200) | |
| agentTranslatedZoneURI | Varchar(2048) | |
| agentVersion | Varchar(31) | The version of the ArcSight connector that processed the event. |
| agentZoneExternalID | Varchar(200) | |
| categoryDeviceType | Varchar(1023) | The events generated by a device type irrespective of the device group the events belong to. |
| cryptoSignature | Varchar(512) | |
| customerExternalID | Varchar(200) | |
| customerURI | Varchar(2048) | |
| destinationGeoCountryCode | Varchar(1023) | |
| destinationGeoLatitude | Float | The latitudinal value from which the destination’s IP address belongs. |
| destinationGeoLocationInfo | Varchar(1023) | |
| destinationGeoLongitude | Float | The longitudinal value from which the destination’s IP address belongs. |
| destinationGeoPostalCode | Varchar(1023) | |
| destinationGeoRegionCode | Varchar(1023) | |
| destinationProcessId | Integer | Provides the ID of the destination process associated with the event. For example, if an event contains process ID 105, “105” is the process ID. |
| destinationTranslatedPort | Integer | Port after it was translated; for example, a firewall. Valid port numbers are 0 to 65535. |
| destinationTranslatedZoneExternalID | Varchar(200) | |
| destinationTranslatedZoneURI | Varchar(2048) | |
| destinationZoneExternalID | Varchar(200) | |
| deviceAssetId | Varchar(40) | |
| deviceCustomDescriptorId | Varchar(1023) | |
| deviceCustomFloatingPoint1 | Float | One of four floating point fields available to map fields that do not apply to any other in this dictionary. |
| deviceCustomFloatingPoint1Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomFloatingPoint2 | Float | One of four floating point fields available to map fields that do not apply to any other in this dictionary. |
| deviceCustomFloatingPoint2Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomFloatingPoint3 | Float | One of four floating point fields available to map fields that do not apply to any other in this dictionary. |
| deviceCustomFloatingPoint3Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomFloatingPoint4 | Float | One of four floating point fields available to map fields that do not apply to any other in this dictionary. |
| deviceCustomFloatingPoint4Label | Varchar(1023) | All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field. |
| deviceCustomIPv6Address1Bin | Varbinary(16) | |
| deviceCustomIPv6Address1Label | Varchar(1023) | |
| deviceCustomIPv6Address2Bin | Varbinary(16) | |
| deviceCustomIPv6Address2Label | Varchar(1023) | |
| deviceCustomIPv6Address3Bin | Varbinary(16) | |
| deviceCustomIPv6Address3Label | Varchar(1023) | |
| deviceCustomIPv6Address4Bin | Varbinary(16) | |
| deviceCustomIPv6Address4Label | Varchar(1023) | |
| deviceDirection | Varchar(1023) | Any information about what direction the observed communication has taken. The following values are supported: “0” for inbound or “1” for outbound. |
| deviceDnsDomain | Varchar(255) | The DNS domain part of the complete fully qualified domain name (FQDN). |
| deviceDomain | Varchar(1023) | |
| deviceFacility | Varchar(1023) | The facility generating this event. For example, Syslog has an explicit facility associated with every event. |
| deviceMacAddressBin | Binary(16) | |
| deviceNtDomain | Varchar(255) | The Windows domain name of the device address. |
| deviceProcessId | Integer | Provides the ID of the process on the device generating the event. |
| deviceProcessName | Varchar(1023) | Process name associated with the event. An example might be the process generating the syslog entry in UNIX. |
| deviceTimeZone | Varchar(255) | The timezone for the device generating the event. |
| deviceTranslatedAddressBin | Binary(16) | |
| deviceTranslatedZoneExternalID | Varchar(200) | |
| deviceTranslatedZoneURI | Varchar(2048) | The URI for the Translated Zone that the device asset has been assigned to in ArcSight. |
| deviceZoneExternalID | Varchar(200) | |
| eventOutcome | Varchar(63) | Displays the outcome, usually as ‘success’ or ‘failure’. |
| fileCreateTime | Integer | Time when the file was created. |
| fileHash | Varchar(255) | Hash of a file. |
| fileId | Varchar(1023) | An ID associated with a file could be the inode. |
| fileModificationTime | Integer | Time when the file was last modified. |
| filePermission | Varchar(1023) | Permissions of the file. |
| fileSize | Integer | Size of the file. |
| fileType | Varchar(1023) | Type of file (pipe, socket, etc.) |
| id | Integer | |
| locality | Varchar(1023) | |
| normalizedEventTime | Integer | |
| oldFileCreateTime | Integer | Time when old file was created. |
| oldFileHash | Varchar(255) | Hash of the old file. |
| oldFileId | Varchar(1023) | |
| oldFileModificationTime | Integer | Time when old file was last modified. |
| oldFileName | Varchar(1023) | Name of the old file. |
| oldFilePath | Varchar(1023) | Full path to the old file, including the file name itself. Examples: c:\Program Files\ WindowsNT\Accessories \wordpad.exe or /usr/bin/zip |
| oldFilePermission | Varchar(1023) | Permissions of the old file. |
| oldFileSize | Integer | Size of the old file. |
| oldFileType | Varchar(1023) | Type of the old file (pipe, socket, etc.) |
| originator | Varchar(1023) | |
| persistedTime | Integer | |
| rawEvent | Varchar(4000) | |
| reason | Varchar(1023) | The reason an audit event was generated. For example “bad password” or “unknown user”. This could also be an error or return code. Example: “0x1234” |
| requestCookies | Varchar(1023) | Cookies associated with the request. |
| severity | Integer | |
| sourceDnsDomain | Varchar(255) | The DNS domain part of the complete fully qualified domain name (FQDN). |
| sourceGeoCountryCode | Varchar(1023) | |
| sourceGeoLatitude | Float | |
| sourceGeoLocationInfo | Varchar(1023) | |
| sourceGeoLongitude | Float | |
| sourceGeoPostalCode | Varchar(1023) | |
| sourceGeoRegionCode | Varchar(1023) | |
| sourceProcessId | Integer | The ID of the source process associated with the event. |
| sourceTranslatedPort | Integer | A port number after being translated by, for example, a firewall. Valid port numbers are 0 to 65535. |
| sourceTranslatedZoneExternalID | Varchar(200) | |
| sourceTranslatedZoneURI | Varchar(2048) | The URI for the Translated Zone that the destination asset has been assigned to in ArcSight. |
| sourceZoneExternalID | Varchar(200) | |
| version | Varchar(10) | |
| priority | Integer | |
| base_event_ids | Varchar(8000) | |
| correlated_event_id | Integer | |
| extraFields | Varchar(8192) |