For the complete documentation index, see llms.txt. This page is also available as Markdown.

Vectra AI Platform network metadata attributes

The attached PDF document describes the Vectra AI Platform Network metadata.

Please Note!!

This article and the attached document apply to:

  • Respond UX implementations and features that leverage metadata, such as Investigate

  • Quadrant UX implementations, through the usage of Vectra Stream and Vectra Recall products

Bolded items in the below tables signify unique value that Vectra AI provides on top of the standard fields available in unenriched Zeek-formatted metadata.

Common Fields

These fields appear in all metadata streams (except DHCP):

Field
Description

id.ip_ver

IP Version

id.orig_h

Originating endpoint IP address

id.orig_p

Originating endpoint TCP/UDP port

id.resp_h

Responding endpoint IP address

id.resp_p

Responding endpoint TCP/UDP port

local_orig

Boolean indicating if connection was locally originated

local_resp

Boolean indicating if connection was locally responded

orig_hostname

Originating endpoint hostname

orig_huid

Unique identifier for the originating host if it is local

orig_sluid

Unique identifier for the originating host session

resp_hostname

Responding endpoint hostname

resp_huid

Unique identifier for the responding host if it is local

resp_sluid

Unique identifier for the responding host session if it is local

sensor_uid

Unique identifier for Vectra sensor that observed the underlying traffic generating the metadata record

ts

Timestamp when the metadata record is generated. It is in date format (e.g. May 9, 2018, 10:09:25.366)

uid

Unique id of connection

Protocol-Specific Fields

Beacon

Field
Description

beacon_type

The type of beacon. 'single_resp_multiple_sessions' type indicates a beacon to one destination comprising of multiple sessions

beacon_uid

The unique uid of the beacon

duration

Total duration of the BeaconUid

first_event_time

Timestamp of the first observed session for this beacon_uid

ja3

Ja3 hash of client based on client SSL parameters

last_event_time

Timestamp of the last observed session for this beacon_uid

orig_ip_bytes

Total bytes sent from originator to responder for this beacon_uid

proto

L4 protocol value. 6 is TCP, 17 is UDP

proto_name

L4 protocol name (TCP or UDP)

resp_domains

The responder domains in this event

resp_ip_bytes

Total bytes send from responder to originator for this beacon_uid

service

Service (e.g. "http" or "tls")

session_count

The number of sessions that comprise the beacon_uid

uid

The unique uid of the first connection for the reported beacon event

DCE-RPC

Field
Description

domain

Domain of the host

endpoint

Endpoint name looked up from the uuid (e.g. IXnRemote, IWbemLoginClientID)

hostname

Hostname on which the user logged in

operation

Operation seen in the call (e.g. "RemoteCreateInstance")

rtt

Round trip time of request – response

username

Username or account name that logged in. Names ending in '

DHCP

Field
Description

assigned_ip

Assigned IP in response

dhcp_server_ip

DHCP server IP address

dns_server_ips

DNS server ips from DHCP options. DHCP Option 6

lease_time

DHCP lease time. DHCP Option 51

mac

MAC address in request

orig_hostname

Hostname from DHCP options. DHCP Option 12

trans_id

Transaction id

ts

Timestamp when the metadata record is generated. It is in date format (e.g. May 9, 2018, 10:09:25.366)

uid

Unique id of connection

DNS

Field
Description

AA

Authoritative answer. True if server is authoritative for the query

answers

List of answers to the query

auth

List of Authoritative responses for the query

proto

Protocol of DNS transaction—6 (for TCP) or 17 (for UDP)

qclass / qclass_name

Value specifying the query class (e.g. 1 / Internet [IN])

qtype / qtype_name

query type value / descriptive name (e.g. A, AAAA, PTR, TXT)

query

Domain name subject of the query

RA

Recursion available. True if server supports recursive queries

RD

Recursion desired. True if recursive lookup of query requested

rcode / rcode_name

Response code value in the DNS response (e.g. NXDOMAIN, NODATA)

rejected

The DNS query was rejected by the server

saw_query

Whether the full DNS query has been seen

saw_reply

Whether the full DNS reply has been seen

TC

Truncation flag. True if the message was truncated

TTLs

List of TTLs from the answers

total_answers

The total number of resource records in a reply message's answer section

total_replies

The total number of resource records in a reply message's answer, authority, and additional sections

trans_id

16-bit identifier assigned by DNS client

Note: † Field may contain base64 encoded data if the metadata contains invalid UTF-8

HTTP

Field
Description

accept

Value of the Accept header in the request, if present, truncated to 256 bytes

accept_encoding

Value of the Accept-Encoding header in the request, if present, truncated to 256 bytes

cookie

Value of the Cookie header, truncated to 256 bytes

cookie_vars

The variables in the cookie field, without the values

host

Value of the Host header, truncated to 256 bytes

host_multihomed

Boolean attribute that indicates whether the address in the host header is observed to be associated with one or multiple IPs

is_proxied

Boolean value indicative of a proxied request

ja4h

The JA4H fingerprint of the HTTP client

method

HTTP Request Method

orig_ip_bytes

Bytes sent by originator to responder

orig_mime_types

Content type header in originator request

orig_pkts

Number of packets sent from originator to responder

post_data

Binary data of the POST request body. Truncated to 2k size

proxied

Value of x-forwarded-for header (e.g. X-FORWARDED-FOR -> 10.10.15.192)

referrer

Value of the Referrer header, truncated to 256 bytes

request_body_len

HTTP payload bytes in request

request_cache_control

Value of the Cache-Control header in the request, if present, truncated to 256 bytes

request_header_count

Count of headers in request

resp_filename

The name of the file returned by the server (if any)

resp_ip_bytes

Bytes send by responder to originator

resp_mime_types

Value of the Content-Type header in response, truncated to 256 bytes

resp_pkts

Number of packets sent from responder to originator

response_body_len

HTTP payload bytes in response

response_cache_control

Value of the Cache-Control header in the response, if present, truncated to 256 bytes

response_content_disposition

Value of the Content-Disposition header (specifies names of the files to be downloaded as attachment, e.g. 'attachment; filename="filename.jpg"'), truncated to 256 bytes

response_expires

Expires header in response, if present

response_header_count

Count of headers in response

status_code

The status code in the HTTP response

status_msg

The status message corresponding to the status code

uri

URI used in the request, truncated to 512 bytes

user_agent

Value of the User-Agent header, truncated to 512 bytes

iSession Connectivity

Field
Description

application

Applications associated with this session

client_luid_proxy

True if the source address of the connection has been learned as a proxy

conn_state

Connection state. Takes values: S0, S1, SF, REJ, S2, S3, RSTO, RSTR, RSTOS0, RSTRH, SH, SHR, or OTH

dir_confidence

Client/server assignment confidence from 0 to 100

duration

Duration of connection in ms

first_orig_resp_data_pkt

Base64 encoding of the first 16 bytes of the packet from originator to responder, represented as a string

first_orig_resp_data_pkt_time

Timestamp of first data packet from originator to responder

first_orig_resp_pkt_time

Timestamp of first packet from originator to responder

first_resp_orig_data_pkt

Base64 encoding of the first 16 bytes of the packet from responder to originator, represented as a string

first_resp_orig_pkt_time

Timestamp of first packet from responder to originator

first_resp_orig_data_pkt_time

Timestamp of first data packet from responder to originator

ja4lc

The JA4L fingerprint of the client's light distance

ja4ls

The JA4LS fingerprint of the server's light distance

ja4t

The JA4T fingerprint of the client's TCP SYN packet

ja4ts

The JA4TS fingerprint of the server's TCP SYN ACK packet(s)

orig_ip_bytes

Bytes sent from originator to responder

orig_pkts

Number of packets sent from originator to responder

orig_vlan_id

VLAN_id of originator, if any

proto

L4 protocol value. 6 is TCP, 17 is UDP

protoName

L4 protocol name (TCP, UDP or ICMP)

proxy_to_internal_dst

True if effective destination after proxy is internal IP

resp_domain

Calculated from TLS SNI, HTTP Host, or the destination IP name (in this exact order)

resp_ip_bytes

Bytes send from responder to originator

resp_multihomed

Boolean attribute that indicates whether the domain is observed to be associated with one or multiple IPs

resp_pkts

Number of packets sent from responder to originator

resp_vlan_id

VLAN_id of responder, if any

service

Service (e.g. "smb")

server_luid_proxy

True if the destination address of the connection has been learned as a proxy

session_start_time

Timestamp when session started

Connection State Values

State
Description

S0

Connection attempt seen, no reply

S1

Connection established, not terminated

SF

Normal establishment and termination. Note that this is the same symbol as for state S1. You can tell the two apart because for S1 there will not be any byte counts in the summary, while for SF there will be

REJ

Connection attempt rejected

S2

Connection established and close attempt by originator seen (but no reply from responder)

S3

Connection established and close attempt by responder seen (but no reply from originator)

RSTO

Connection established, originator aborted (sent a RST)

RSTR

Responder sent a RST

RSTOS0

Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder

RSTRH

Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator

SH

Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open)

SHR

Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator

OTH

No SYN seen, just midstream traffic (one example of this is a "partial connection" that was not later closed)

Kerberos

Field
Description

account_privilege

Privilege level of the account. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9)

account_uid

Account unique identifier (principal@REALM format)

as_rep_padata_count

Total PA-DATA entries seen on AS-REP prior to truncation

as_rep_padata_types

PA-DATA type integers from AS-REP messages (12 max)

as_rep_padata_types_string

Human readable PA-DATA type names for AS-REP messages (12 max)

as_req_padata_count

Total PA-DATA entries seen on AS-REQ prior to truncation

as_req_padata_types

PA-DATA type integers from AS-REQ messages (12 max)

as_req_padata_types_string

Human readable PA-DATA type names for AS-REQ messages (12 max)

client

Client name, including realm

data_source

The source of the record, either "network" or "log"

error_code

Error code if not a success

error_msg

Error message if not a success

orig_host_observed_privilege

The privilege represents the observed privilege based on the activity of an account seen to operate from the host. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9)

protocol

L4 protocol. 6 (TCP) or 17 (UDP)

rep_cipher

Cipher selected in reply message

reply_timestamp

Timestamp of reply

req_ciphers

Ordered list of requested ciphers

request_type

Type of request (AS or TGT)

service

Service being requested, including realm

service_privilege

Privilege level of the service. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9)

service_uid

Service unique identifier (principal@REALM format)

success

Whether request was success or not

ticket_cipher

Ticket cipher observed on AS-REP and TGS-REP replies

LDAP

Field
Description

attributes

A set of attributes to request for inclusion in entries that match the search criteria and are returned

baseObject

Base of the subtree in which the search is to be constrained

bind_error_count

If there are bind errors, count of the errors

duration

Duration of the session

encrypted_sasl_payload_count

If sasl encryption is used, the number of encrypted sasl payloads encountered

error

The error message in case of error (e.g. "0000208D: NameErr …")

logon_failure_error_count

The count of logon errors

is_close

Boolean flag indicating whether the close was observed

is_query

Boolean flag indicating whether the query was observed in the request

matched_dn

The matched distinguished name

message_id

Message id

query

Criteria to use to identify which entries within the scope should be returned

query_scope

The portion of the target subtree that should be considered (e.g. wholeSubtree)

response_bytes

Number of bytes in the response

result

The result of the query in this request

request_bytes

Number of bytes in the request

result_code

The result code (success or failure) in the response

result_count

The count of the entries in the result

Match (Alert/IDS Data)

Field
Description

eve_json.alert.category

Category of the Alert Message

eve_json.alert.gid

Unique identifier for group of signatures. Defaults to 1 for most signatures

eve_json.alert.metadata.affected_product

Specifies details on the affected product

eve_json.alert.metadata.attack_target

Specifies if the attack target is the Client, Server, Both, or Other

eve_json.alert.metadata.created_at

Specifies the date the signature was created

eve_json.alert.metadata.deployment

Specifies where the signature should be deployed

eve_json.alert.metadata.malware_family

Specifies the Malware Family that is associated with the signature

eve_json.alert.metadata.policy

Specifies details on the alert policy

eve_json.alert.metadata.signature_severity

Describes the severity associated with the signature

eve_json.alert.metadata.tag

Specifies any tag information assigned to the signature by the author

eve_json.alert.metadata.updated_at

Specifies the data of the last update to the signature

eve_json.alert.rev

Alert signature revision number indicating if the signature has been updated

eve_json.alert.rule

Specifies the rule that fired the alert

eve_json.alert.severity

Number representing the severity of the alert

eve_json.alert.signature

The rule name. Based on the 'msg' text in the signature

eve_json.alert.signature_id

Alert signature Identifier

eve_json.alert.xff

Value of x-forwarded-for

eve_json.direction

Specifies the traffic direction of the alert

eve_json.packet

Specifies the packet that triggered the signature

eve_json.payload

Provides the Base64 Encoded packet payload information

eve_json.payload_printable

Provides the payload presented in ASCII

eve_json.proto

L4 protocol name

NTLM

Field
Description

domain

Domain of the host

hostname

Hostname on which the user logged in

status

Status code in response

success

Whether the request was successful or not

username

Username or account name that logged in

Radius

Field
Description

account_authentic

Identifies how the user was authenticated

account_delay_time

Identifies how long the sender has been trying to send the message for

account_input_gigawords

Identifies how many times the Acct-Input counter has rolled over for input

account_input_octets

How many bytes have been received

account_input_packets

How many packets the system has received

account_output_gigawords

Identifies how many times the Acct-Input counter has rolled over for output

account_output_octets

How many bytes have been set

account_output_packets

How many packets the system has sent

account_session_id

This is a unique ID that identifies the RADIUS Accounting Session which is sent in a separate packet

account_session_time

Duration of service received by user

calling_station_id

This is the identifier of the calling station

connect_info

Identify the speed of the connection or other connection related information

delegated_ipv6_prefix

IPv6 Pool from which the IPv6 address was assigned

dst_display_name

DNS Name of the Destination

dst_host_luid

This is the ID of the destination host with host ID

dst_luid

The LUID of the RADIUS Server

dst_luid_external

Value is True if the destination is external

event_timestamp

Similar to ts but is the timestamp from the device, not from Vectra

filter_id

This identifies any ACL that is in use

framed_address

This field is available in the request that identifies the endpoint requesting authentication

framed_interface

Identifies the interface used when the user connects to the system

framed_ip_address

IP address of the endpoint device connecting to the system

framed_ipv6_prefix

Indicates the framed IPv6 prefix for the user

framed_protocol

Identifies the Framed Protocol used when the user connects to the system

idle_timeout

Amount of time a session can be idle before it is disconnected

logged

The boolean attribute indicates if the request was previously logged

mac

MAC Address if observed as a field in the Radius message

nas_identifier

Identifies the role the authenticating client is requesting

nas_ip_address

This is an IP Address format, it can be the IP of the Device, the Endpoint, or Intermediate system, depending on implementation

nas_port

Physical Port Number of the Device Authenticating the User

nas_port_id

Text string identifying the port provided by the client

nas_port_type

This is the type of medium of the port (e.g. Ethernet, Wifi &c.)

password_seen

Boolean attribute indicating password was seen

radius_type

The value indicates if it is an access or accounting request

reply_msg

Reply message from the server challenge. This is frequently shown to the user authenticating

reply_timestamp

Timestamp when the reply message was received

result

Success or Failed Authentication

service_type

Type of service the user has requested

session_timeout

This is the maximum session length

src_display_name

DNS Name of the Source

src_host_luid

This is the ID of the Src with Host ID

src_luid

The LUID of the RADIUS Client

src_luid_external

Value is True if the source is external

ttl

The duration between the first request and either the "AccessAccept" message or an error. If the field is empty, it means that either the request or response was not seen

tunnel_client

Address (IPv4, IPv6, or FQDN) of the initiator end of the tunnel, if present. This is collected from the Tunnel-Client-Endpoint attribute

username

This is the username if observed in the Radius message

RDP

Field
Description

client_build

RDP client version used by client machine. Will be "unknown" if encrypted

client_dig_product_id

Product ID of the client machine

client_name

Hostname of the client machine.

cookie

Cookie value used by the client. Generally represents the username. It could be truncated by the client application.

desktop_height

Desktop height of client machine. 0 if encrypted

desktop_width

Desktop width of client machine. 0 if encrypted

keyboard_layout

Keyboard layout (language) of client machine (e.g. "US" "Encrypted Keyboard Layout")

result

If encrypted, result value is "encrypted" otherwise it will be empty

SMB Files

Field
Description

action

Action taken on file

delete_on_close

Flag indicating if the delete_on_close attribute is enabled. If enabled, a file close action may delete the file if it is the last close on the file

domain

Domain of the SMB server

hostname

Hostname of the SMB client

path

Path pulled from the tree this file was transferred to or from

prev_name

If the rename action was seen, this will be the file's previous name

name

Filename if one was seen

username

Username or account name that logged in. Names ending in '$' are machine names (not user account names)

version

SMB version (SMBv1 or SMBv2)

SMB Mapping

Field
Description

domain

Domain of the SMB server

hostname

Hostname of the SMB client

path

Name of the tree path

service

Type of re-originator of the tree

username

Username or account name that logged in. Names ending in '$' are machine names (not user account names)

version

SMB version (SMBv1 or SMBv2)

SMTP

Field
Description

cc

Contents of the CC header, formatted as a comma separated list

date

Contents of the Date header

dkim_status

pass/fail/none. Based on the 'Authentication-results' header

dmarc_status

pass/fail/none. Based on the 'Authentication-results' header

first_received

Contents of the first Received header, which signifies the first SMTP server to receive this message, (i.e. sending server)

from

Contents of the From header

helo

Contents of the Helo header

in_reply_to

Contents of the In-Reply-To header

mail_from

Email addresses found in the From header

msgid

Contents of the MsgID header

rcpt_to

Email addresses found in the Rcpt header, formatted as a comma separated list

reply_to

Contents of the ReplyTo header

second_received

Contents of the second Received header, which signifies the second SMTP server to receive this message

subject

Contents of the Subject header

spf_helo_status

Based on the 'Received-SPF' header in smtp. This header specifies the SPF status (Sender Policy Framework). One of pass/fail/neutral/softfail/none/temperror/permerror. See: https://tools.ietf.org/html/rfc7208#section-9.1

spf_mailfrom_status

One of pass/fail/neutral/softfail/none/temperror/permerror

tls

Indicates that the connection has switched to using TLS

to

Contents of the To header, formatted as a comma separated list

user_agent

Value of the User-Agent header from the client

x_originating_ip

Contents of the X-Originating-IP header

SSH

Field
Description

client

The client's version string

cipher_alg

The encryption algorithm in use

compression_alg

The compression algorithm in use

hassh

hassh hash of client based on client SSH parameters

hasshServer

haashServer hash of server based on client SSH parameters

host_key

The server's key fingerprint

host_key_alg

The server host key's algorithm

kex_alg

The key exchange algorithm in use

mac_alg

The signing (MAC) algorithm in use

server

The server's version string

version

SSH major version (1 or 2)

SSL

Field
Description

application

Applications associated with this session

cipher

SSL/TLS cipher suite chosen from server

client_curve_num

Elliptical curve number sent by the client

client_ec_point_format

Elliptical curve point format offered by the client

client_extension

Client extensions

client_issuer

Client cert issuer

client_luid_proxy

True if the source address of the connection has been learned as a proxy

client_subject

Client cert subject

client_version

SSL version string sent by the client

client_version_num

SSL version number sent by the client

curve

Elliptical curve number for ECDHE

established

Flag to indicate if this ssl session has been established successfully, or if it was aborted during the handshake

issuer

Server cert issuer

ja3

JA3 hash of client based on client SSL parameters

ja3s

JA3S hash of server based on server SSL parameters

ja4

The JA4 fingerprint of the TLS client

ja4s

The JA4S fingerprint of the TLS server response

next_protocol

Next protocol the server chose using the application layer next protocol extension, if present

proxy_to_internal_dst

True if effective destination after proxy is internal ip

server_extensions

Server extensions

server_luid_proxy

True if the destination address of the connection has been learned as a proxy

server_name

SNI value

subject

Server cert subject

version

SSL/TLS version that the server chose

version_num

Numeric SSL/TLS version that the server chose

X509

Field
Description

application

Applications associated with this session

basic_constraints.ca

Flag indicating whether the subject of the certificate is a CA

basic_constraints.path_len

Maximum depth of valid certification paths that include this certificate

certificate.cn

Common name that identifies the host name of the certificate

certificate.curve

Curve, if EC-certificate

certificate.exponent

Key exponent

certificate.issuer

Combination of country, organizations, common name, issuer, URI

certificate.key_alg

Name of the public key algorithm that is used in data transmission, e.g. RSA encryption

certificate.key_length

Number of bits used in the encryption, e.g. 2,048-bit encryption

certificate.key_type

Three key types, depending upon the key algorithm

certificate.not_valid_after

Time after the certificate is invalid

certificate.not_valid_before

Time before the certificate is invalid

certificate.self_issued

Boolean flag indicating whether the certificate is self-issued or backed by a CA

certificate.serial

Unique serial number given by certificate authority or certificate signed authority. Usually 40 hexadecimal characters

certificate.sig_alg

Name of the signature algorithm

certificate.subject

Owner of the certificate (distinguished name)

certificate.version

Version of the server certificate (SSL V3, TLS 1.0, TLS 1.1, etc.)

client_luid_proxy

True if the source address of the connection has been learned as a proxy

ja4x

The JA4X fingerprint of the X.509 TLS certificate

proxy_to_internal_dst

True if effective destination after proxy is internal ip

san.dns

Specifying a list of additional host names for a single certificate along with DNS names that are associated with SAN (Subject Alternative Name)

san.email

Email address associated with the SAN

san.ip

IP address of the SAN in the digital certificate

san.other_fields

Other fields in the SAN

san.uri

URL name associated with SAN

server_luid_proxy

True if the destination address of the connection has been learned as a proxy

Last updated

Was this helpful?