Investigate API metadata schema reference

Available Tables and Fields for RUX Investigate (Metadata) API Queries

Use this reference to identify available tables and fields when writing queries via POST /api/v3.4/investigations/. All table names require the ._all suffix. Struct fields must use dot-notation in WHERE and ORDER BY clauses (e.g. id.resp_h, not resp_h). Use timestamp for time-based filtering in all tables.

Tip: This reference is written for the Investigate API, but the table and field names are identical to those used in the SQL Search or Basic Search Filters within the Investigate UI in the Vectra console). If you're building queries directly in the UI rather than via the API, this document applies equally — use the same table names, field names, and dot-notation rules.

Query Constraints

Network Tables (`network.*._all`)

Constraint

Value

Max lookback

14 days

Max rows per query

1,000

LIMIT clause

Required in every query

Supported clauses

SELECT, FROM, WHERE, ORDER BY, LIMIT, UNION ALL

Prohibited

JOIN, plain UNION, subqueries, GROUP BY, HAVING, INSERT, UPDATE, DELETE

Cloud Tables (`aws.._all`, `azurecp.._all`, `entra.._all`, `m365.._all`)

Constraint

Value

Max lookback

14 days

Max rows per query

1,000

LIMIT clause

Required in every query

Supported clauses

SELECT, FROM, WHERE, ORDER BY, LIMIT, GROUP BY

Struct dot-notation required — In WHERE and ORDER BY, always use dot-notation for struct fields (e.g. id.resp_h, user_identity.type, actor.name). Using flat field names returns a 400 error.

Available Tables

AWS

aws.cloudtrail._all

Azure Control Plane

azurecp.operations._all

Microsoft Entra ID

entra.signins._all
entra.directoryaudits._all

Microsoft 365

m365.exchange._all
m365.sharepoint._all
m365.general._all
m365.active_directory._all

Network

Network metadata tables capture raw protocol-level activity observed by Vectra sensors on your network. Use these tables to investigate host behavior, lateral movement, command-and-control activity, and data exfiltration across protocols including DNS, HTTP, Kerberos, LDAP, SMB, and more.

network.beacon._all

Aggregated beaconing pattern records — periodic automated sessions from internal hosts to external destinations, summarised per beacon_uid.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

orig_huid

string

✓

Originator host LUID

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

beacon_uid

string

✓

Unique identifier for this beacon aggregate

beacon_type

string

✓

Beacon classification. Known value: single_resp_multiple_sessions

duration

number

Total duration of the beacon_uid in milliseconds

first_event_time

timestamp

Timestamp of the first observed session for this beacon_uid

last_event_time

timestamp

Timestamp of the last observed session for this beacon_uid

ja3

string

JA3 hash of the TLS client fingerprint based on SSL parameters

orig_ip_bytes

number

Total bytes sent originator → responder across all sessions in this beacon_uid

proto

number

L4 protocol number — 6 (TCP), 17 (UDP)

proto_name

string

L4 protocol name — "TCP" or "UDP"

resp_domains

array[string]

Responder domains observed across sessions in this beacon_uid

resp_ip_bytes

number

Total bytes sent responder → originator across all sessions in this beacon_uid

service

string

Inferred application service (e.g. "tls", "http")

session_count

number

Number of individual sessions aggregated into this beacon_uid

network.dce_rpc._all

Microsoft DCE/RPC protocol records — each row is one RPC call, useful for detecting lateral movement, credential abuse, and remote execution via Windows RPC interfaces.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

username

string

✓

Username or account name observed. Names ending in $ are machine accounts.

hostname

string

✓

Hostname on which the user logged in

domain

string

✓

Domain of the host

rtt

number

Round-trip time of request–response in microseconds

endpoint

string

Endpoint (interface) name looked up from UUID (e.g. lsarpc, IXnRemote, IWbemLoginClientID)

operation

string

Operation seen in the call (e.g. LsarLookupSids3, RemoteCreateInstance)

network.dhcp._all

DHCP transaction records — tracks IP-to-hostname and IP-to-MAC mappings over time.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

orig_sluid

string

✓

Originator session LUID

orig_huid

string

✓

Originator host LUID

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

mac

string

MAC address from the DHCP request

assigned_ip

string

IP address assigned in the DHCP response

trans_id

number

DHCP transaction ID

lease_time

number

DHCP lease time in seconds (DHCP Option 51)

server_addr

string

DHCP server IP address. Note: PDF documents this field as dhcp_server_ip — actual live field name is server_addr.

dns_server_ips

array[string]

✓

DNS server IPs from DHCP Option 6

hour

number

✓

Hour of day (0–23) for the record. Not documented in PDF.

network.dns._all

DNS query and response records — provide visibility into domain resolution activity, including queries, responses, and resolution outcomes.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

proto

number

Protocol of DNS transaction — 6 (TCP) or 17 (UDP)

trans_id

number

16-bit transaction ID assigned by DNS client

query

string

Domain name queried. PDF note: may contain base64-encoded data if the domain contains invalid UTF-8.

qclass

number

Query class value (e.g. 1 = Internet [IN])

qclass_name

string

Query class name (e.g. "Internet (IN)")

qtype

number

Query type value (e.g. 1=A, 28=AAAA, 12=PTR, 16=TXT)

qtype_name

string

Query type name (e.g. "A", "AAAA", "PTR", "TXT")

rcode

number

Response code value

rcode_name

string

Response code name (e.g. "NoError", "NXDOMAIN", "NODATA")

rejected

boolean

True if the DNS query was rejected by the server

total_answers

number

Total number of resource records in the reply answer section

total_replies

number

Total number of resource records in reply answer, authority, and additional sections

saw_query

boolean

True if the full DNS query was observed

saw_reply

boolean

True if the full DNS reply was observed

answers

array[string]

List of answers to the query. May contain base64-encoded data if answers contain invalid UTF-8.

answers_error

string

✓

Error information for answer parsing failures. Not documented in PDF.

auth

array[string]

List of authoritative responses for the query

ttls

array[number]

List of TTL values from the answers. PDF: TTLs

aa

boolean

Authoritative answer — True if server is authoritative for the query. PDF: AA

tc

boolean

Truncation flag — True if the message was truncated. PDF: TC

rd

boolean

Recursion desired — True if recursive lookup requested. PDF: RD

ra

boolean

Recursion available — True if server supports recursive queries. PDF: RA

network.http._all

HTTP session records — URIs, methods, user-agents, response codes, and data volumes.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

method

string

HTTP request method (e.g. "GET", "POST", "PUT")

host

string

Value of the Host header, truncated to 256 bytes

host_multihomed

boolean

✓

True if the Host header IP is observed associated with multiple IPs

uri

string

URI in the request, truncated to 512 bytes

referrer

string

Referrer header value, truncated to 256 bytes

user_agent

string

User-Agent header value, truncated to 512 bytes

request_body_len

number

HTTP payload bytes in request

response_body_len

number

HTTP payload bytes in response

status_code

number

HTTP response status code (e.g. 200, 404, 500)

status_msg

string

HTTP response status message (e.g. "OK", "Not Found")

resp_filename

string

Name of the file returned by the server, if any

proxied

array[string]

Value of X-Forwarded-For header (e.g. X-FORWARDED-FOR -> 10.10.15.192)

is_proxied

boolean

✓

True if the request is a proxied request

orig_mime_types

array[string]

Content-Type headers in originator request

resp_mime_types

array[string]

Content-Type headers in response (truncated to 256 bytes)

cookie

string

✓

Value of the Cookie header, truncated to 256 bytes

response_content_disposition

string

Value of Content-Disposition header in response (e.g. attachment; filename="file.jpg")

request_header_count

number

✓

Count of headers in request

response_header_count

number

✓

Count of headers in response

cookie_vars

array[string]

✓

Variables in the cookie field (without values)

orig_ip_bytes

number

✓

Bytes sent by originator to responder

resp_ip_bytes

number

✓

Bytes sent by responder to originator

orig_pkts

number

✓

Number of packets sent from originator to responder

resp_pkts

number

Number of packets sent from responder to originator

request_cache_control

string

✓

Cache-Control header in request (truncated to 256 bytes)

response_cache_control

string

✓

Cache-Control header in response (truncated to 256 bytes)

response_expires

string

✓

Expires header in response

ja4h

string

JA4H fingerprint of the HTTP client

accept

string

Value of the Accept header, truncated to 256 bytes

accept_encoding

string

Value of the Accept-Encoding header, truncated to 256 bytes

post_data

string

Binary data of the POST request body, truncated to 2 KB

network.isession._all

IP sessions across all protocols — the broadest network table, highest volume; use for traffic baselines and protocol analysis.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

proto

number

IP protocol number (6=TCP, 17=UDP, 1=ICMP)

proto_name

string

Protocol name — "TCP", "UDP", "ICMP"

service

string

Inferred application service (e.g. "dns", "http", "tls", "ssl")

duration

number

Session duration in milliseconds

conn_state

string

Zeek connection state code — see Key Notes for values

orig_pkts

number

Packet count, originator → responder

orig_ip_bytes

number

IP byte count, originator → responder

resp_pkts

number

Packet count, responder → originator

resp_ip_bytes

number

IP byte count, responder → originator

resp_domain

string

✓

Calculated from TLS SNI, HTTP Host, or the destination IP name (in this exact order) PDF: resp_domain*

resp_multihomed

boolean

✓

True if responder IP resolves to multiple hosts

orig_vlan_id

number

✓

VLAN ID for originator segment

resp_vlan_id

number

✓

VLAN ID for responder segment

first_orig_resp_pkt_time

timestamp

✓

Timestamp of first packet: originator → responder

first_resp_orig_pkt_time

timestamp

✓

Timestamp of first packet: responder → originator

first_orig_resp_data_pkt_time

timestamp

✓

Timestamp of first data packet: originator → responder

first_resp_orig_data_pkt_time

timestamp

✓

Timestamp of first data packet: responder → originator

session_start_time

timestamp

Session start timestamp (second precision)

first_orig_resp_data_pkt

string

✓

First data payload, originator → responder (base64 encoded)

first_resp_orig_data_pkt

string

✓

First data payload, responder → originator (base64 encoded)

application

array[string]

Detected application layer protocols (e.g. ["http2"])

dir_confidence

number

✓

Confidence score (0–100) for traffic direction classification

ja4lc

string

JA4L fingerprint of the client's light distance

ja4ls

string

JA4LS fingerprint of the server's light distance

ja4t

string

JA4T fingerprint of the client's TCP SYN packet

ja4ts

string

JA4TS fingerprint of the server's TCP SYN ACK packet(s)

proxy_to_internal_dst

boolean

✓

True if session is proxied to an internal destination

client_luid_proxy

boolean

✓

True if the source address of the connection has been learned as a proxy

server_luid_proxy

boolean

✓

True if the destination address of the connection has been learned as a proxy

network.kerberos._all

Kerberos authentication events — including AS-REQ and TGS-REQ flows — provide visibility into ticket-issuance patterns and support security investigations of Kerberos-based attack techniques.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

data_source

string

Source of the record — "network" or "log"

request_type

string

Type of Kerberos request — "AS" (initial auth) or "TGS" (service ticket)

client

string

Client name including realm (e.g. Administrator/ARCHER.LOCAL)

service

string

Service being requested including realm (e.g. krbtgt/ARCHER.LOCAL)

success

boolean

True if the Kerberos request was successful

error_code

number

Error code if not a success

error_msg

string

Error message if not a success

protocol

number

✓

L4 protocol — 6 (TCP) or 17 (UDP). Note: field is named protocol not proto in this table.

reply_timestamp

timestamp

✓

Timestamp of the Kerberos reply message

orig_host_observed_privilege

number

✓

Privilege level observed for account operating from this host. Scores: Low (1,2), Medium (3–7), High (8,9)

req_ciphers

array[string]

Ordered list of encryption types requested by the client

rep_cipher

string

Encryption type selected in the reply message

account_uid

string

✓

Account unique identifier in principal@REALM format

service_uid

string

✓

Service unique identifier in principal@REALM format

account_privilege

number

✓

Privilege level of the account. Scores: Low (1,2), Medium (3–7), High (8,9)

service_privilege

number

✓

Privilege level of the service. Scores: Low (1,2), Medium (3–7), High (8,9)

ticket_cipher

string

Ticket cipher observed on AS-REP and TGS-REP replies

as_req_padata_types

array[number]

PA-DATA type integers from AS-REQ messages (max 12)

as_req_padata_types_string

array[string]

Human-readable PA-DATA type names for AS-REQ messages

as_rep_padata_types

array[number]

PA-DATA type integers from AS-REP messages (max 12)

as_rep_padata_types_string

array[string]

Human-readable PA-DATA type names for AS-REP messages

as_req_padata_count

number

Total PA-DATA entries seen in AS-REQ prior to truncation

as_rep_padata_count

number

Total PA-DATA entries seen in AS-REP prior to truncation

network.ldap._all

LDAP query records — directory lookups, reconnaissance, and sensitive attribute access.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

uid

string

Unique session/connection ID (Zeek UID)

sensor_uid

string

✓

Short sensor identifier

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

message_id

number

LDAP message ID

base_object

string

Base of the subtree in which the search is constrained

query_scope

string

Scope of the target subtree (e.g. baseObject, singleLevel, wholeSubtree)

query

string

LDAP filter criteria. May contain base64-encoded data if the filter contains invalid UTF-8.

result

string

Result of the LDAP operation (e.g. "success")

result_code

number

LDAP result code

matched_dn

string

Matched distinguished name (populated on some error responses)

error

string

Error message if an error occurred (e.g. "0000208D: NameErr ...")

duration

number

Duration of the LDAP session

request_bytes

number

Number of bytes in the request

response_bytes

number

Number of bytes in the response

is_close

boolean

True if the connection close was observed

is_query

boolean

True if the operation was a query (search request)

attributes

array[string]

Set of attributes requested in the search

bind_error_count

number

Count of bind errors (failed authentication attempts)

logon_failure_error_count

number

Count of logon failure errors

result_count

number

Count of entries returned in the result

encrypted_sasl_payload_count

number

Count of encrypted SASL payloads encountered (if SASL encryption is in use)

network.match._all

Vectra AI Match events — Suricata-based IDS alerts generated from network traffic, exposing signature matches and associated EVE JSON metadata.

Common Fields

Column

Type

Vectra-specific*

Description

vectra_connector

string

✓

Sensor/connector identifier. Not documented in the Vectra metadata PDF.

id

struct

Session 5-tuple

id.ip_ver

string

IP version — "ipv4" or "ipv6"

id.orig_h

string

Originator (client) IP address

id.orig_p

number

Originator source port

id.resp_h

string

Responder (server) IP address

id.resp_p

number

Responder destination port

timestamp

Record timestamp (PDF documents as ts — use timestamp in all queries)

local_orig

boolean

True if originator IP is internal/RFC-1918

local_resp

boolean

True if responder IP is internal/RFC-1918

orig_sluid

string

✓

Originator session LUID

resp_sluid

string

✓

Responder session LUID (empty for external hosts)

orig_huid

string

✓

Originator host LUID

resp_huid

string

✓

Responder host LUID (null for external hosts)

orig_hostname

struct

✓

Vectra host record for originator

orig_hostname.id

number

✓

Vectra host entity ID — links to GET /api/v3.4/hosts/{id}

orig_hostname.name

string

✓

Host display name

orig_hostname.host_luid

string

✓

Host LUID

resp_hostname

struct

✓

Vectra host record for responder (null fields for external IPs)

resp_hostname.id

number

✓

Vectra host entity ID

resp_hostname.name

string

✓

Host display name

resp_hostname.host_luid

string

✓

Host LUID

dt

string

✓

Date partition field (YYYY-MM-DD). Use timestamp for sub-day precision. Not documented in the Vectra metadata PDF.

Table-Specific Fields

Column

Type

Vectra-specific*

Description

app_proto

string

Application protocol inferred for this alert (e.g. "tls", "http", "dns")

alert

struct

Suricata alert details (see sub-fields below)

alert.category

string

Alert category (e.g. "Generic Protocol Command Decode", "Malware")

alert.signature_id

number

Suricata rule signature ID (SID)

alert.rev

number

Signature revision number

alert.signature

string

Signature name / message text

alert.severity

number

Alert severity level (1=Critical, 2=Major, 3=Minor)

alert.rule

string

The full rule text that fired the alert

alert.metadata

struct

Additional signature metadata

alert.metadata.attack_target

array[string]

Affected component (Client, Server, Both, Other)

alert.metadata.created_at

array[string]

Date the signature was created

alert.metadata.deployment

array[string]

Where the signature should be deployed

alert.metadata.malware_family

array[string]

Associated malware family name

alert.metadata.tag

array[string]

Signature tags

alert.metadata.updated_at

array[string]

Date of last signature update

alert.metadata.signature_severity

array[string]

Severity metadata from the signature author

payload

string

Base64-encoded packet payload that triggered the alert

payload_printable

string

ASCII printable representation of the payload

packet

string

Base64-encoded full packet

flow

struct

Suricata flow counters for the associated network flow

flow.bytes_toclient

number

Bytes sent toward the client in this flow

flow.bytes_toserver

number

Bytes sent toward the server in this flow

flow.pkts_toclient

number

Packets sent toward the client in this flow

flow.pkts_toserver

number

Packets sent toward the server in this flow

flow.src_ip

string

Source IP for this flow

flow.src_port

number

Source port for this flow

flow.dest_ip

string

Destination IP for this flow

flow.dest_port

number

Destination port for this flow

flow.start

string

Flow start timestamp (ISO 8601 string)

direction

string

Traffic direction of the alert — "to_client" or "to_server"

dns

struct

DNS protocol data if alert is DNS-related (null otherwise)

http

struct

HTTP protocol data if alert is HTTP-related (null otherwise)

tls

struct

TLS protocol data if alert is TLS-related (null otherwise)

ftp

struct

FTP protocol data if alert is FTP-related (null otherwise)

ftp_data

struct

FTP data channel details (null otherwise)

smb

struct

SMB protocol data if alert is SMB-related (null otherwise)

ssh

struct

SSH protocol data if alert is SSH-related (null otherwise)

rdp

struct

RDP protocol data if alert is RDP-related (null otherwise)

anomaly

struct

Anomaly data if alert is anomaly-based (null otherwise)

bittorrent_dht

struct

BitTorrent DHT data (null otherwise)

rfb

struct

RFB/VNC protocol data (null otherwise)

mqtt

struct

MQTT protocol data (null otherwise)

http2

struct

HTTP/2 protocol data (null otherwise)

pgsql

struct

PostgreSQL protocol data (null otherwise)

ike

struct

IKE/IPsec protocol data (null otherwise)

Good night

Query Constraints

Network Tables (network.*._all)

Cloud Tables (aws.*._all, azurecp.*._all, entra.*._all, m365.*._all)

Available Tables

Network

AWS

Azure Control Plane

Microsoft Entra ID

Microsoft 365

Network

network.beacon._all

Common Fields

Table-Specific Fields

network.dce_rpc._all

Common Fields

Table-Specific Fields

network.dhcp._all

Common Fields

Table-Specific Fields

network.dns._all

Common Fields

Table-Specific Fields

network.http._all

Common Fields

Table-Specific Fields

network.isession._all

Common Fields

Table-Specific Fields

network.kerberos._all

Common Fields

Table-Specific Fields

network.ldap._all

Common Fields

Table-Specific Fields

network.match._all

Common Fields

Table-Specific Fields

Network Tables (`network.*._all`)

Cloud Tables (`aws.._all`, `azurecp.._all`, `entra.._all`, `m365.._all`)