> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/reference/metadata-attributes/vectra-ai-platform-network-metadata-attributes.md). # Vectra AI Platform network metadata attributes The attached PDF document describes the Vectra AI Platform Network metadata. ## Please Note!! This article and the attached document apply to: * **Respond UX** implementations and features that leverage metadata, such as *Investigate* * **Quadrant UX** implementations, through the usage of **Vectra Stream** and **Vectra Recall** products **Bolded** items in the below tables signify unique value that Vectra AI provides on top of the standard fields available in unenriched Zeek-formatted metadata. ## Common Fields These fields appear in all metadata streams (except DHCP): | Field | Description | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | [**`id.ip_ver`**](#user-content-fn-1)[^1] | IP Version | | `id.orig_h` | Originating endpoint IP address | | `id.orig_p` | Originating endpoint TCP/UDP port | | `id.resp_h` | Responding endpoint IP address | | `id.resp_p` | Responding endpoint TCP/UDP port | | `local_orig` | Boolean indicating if connection was locally originated | | `local_resp` | Boolean indicating if connection was locally responded | | [**`orig_hostname`**](#user-content-fn-1)[^1] | Originating endpoint hostname | | [**`orig_huid`**](#user-content-fn-1)[^1] | Unique identifier for the originating host if it is local | | [**`orig_sluid`**](#user-content-fn-1)[^1] | Unique identifier for the originating host session | | [**`resp_hostname`**](#user-content-fn-1)[^1] | Responding endpoint hostname | | [**`resp_huid`**](#user-content-fn-1)[^1] | Unique identifier for the responding host if it is local | | [**`resp_sluid`**](#user-content-fn-1)[^1] | Unique identifier for the responding host session if it is local | | `sensor_uid` | Unique identifier for Vectra sensor that observed the underlying traffic generating the metadata record | | `ts` | Timestamp when the metadata record is generated. It is in date format (e.g. May 9, 2018, 10:09:25.366) | | `uid` | Unique id of connection | ## Protocol-Specific Fields ### Beacon[^2] | Field | Description | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------- | | `beacon_type` | The type of beacon. 'single\_resp\_multiple\_sessions' type indicates a beacon to one destination comprising of multiple sessions | | `beacon_uid` | The unique uid of the beacon | | `duration` | Total duration of the BeaconUid | | `first_event_time` | Timestamp of the first observed session for this beacon\_uid | | `ja3` | Ja3 hash of client based on client SSL parameters | | `last_event_time` | Timestamp of the last observed session for this beacon\_uid | | `orig_ip_bytes` | Total bytes sent from originator to responder for this beacon\_uid | | `proto` | L4 protocol value. 6 is TCP, 17 is UDP | | `proto_name` | L4 protocol name (TCP or UDP) | | `resp_domains` | The responder domains in this event | | `resp_ip_bytes` | Total bytes send from responder to originator for this beacon\_uid | | `service` | Service (e.g. "http" or "tls") | | `session_count` | The number of sessions that comprise the beacon\_uid | | `uid` | The unique uid of the first connection for the reported beacon event | ### DCE-RPC | Field | Description | | ---------------------------------------- | -------------------------------------------------------------------------- | | [**`domain`**](#user-content-fn-1)[^1] | Domain of the host | | `endpoint` | Endpoint name looked up from the uuid (e.g. IXnRemote, IWbemLoginClientID) | | [**`hostname`**](#user-content-fn-1)[^1] | Hostname on which the user logged in | | `operation` | Operation seen in the call (e.g. "RemoteCreateInstance") | | `rtt` | Round trip time of request – response | | [**`username`**](#user-content-fn-1)[^1] | Username or account name that logged in. Names ending in ' | ### DHCP | Field | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | `assigned_ip` | Assigned IP in response | | [**`dhcp_server_ip`**](#user-content-fn-1)[^1] | DHCP server IP address | | [**`dns_server_ips`**](#user-content-fn-1)[^1] | DNS server ips from DHCP options. DHCP Option 6 | | `lease_time` | DHCP lease time. DHCP Option 51 | | `mac` | MAC address in request | | [**`orig_hostname`**](#user-content-fn-1)[^1] | Hostname from DHCP options. DHCP Option 12 | | `trans_id` | Transaction id | | `ts` | Timestamp when the metadata record is generated. It is in date format (e.g. May 9, 2018, 10:09:25.366) | | `uid` | Unique id of connection | ### DNS | Field | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------- | | `AA` | Authoritative answer. True if server is authoritative for the query | | `answers`† | List of answers to the query | | `auth` | List of Authoritative responses for the query | | `proto` | Protocol of DNS transaction—6 (for TCP) or 17 (for UDP) | | `qclass` / `qclass_name` | Value specifying the query class (e.g. 1 / Internet \[IN]) | | `qtype` / `qtype_name` | query type value / descriptive name (e.g. A, AAAA, PTR, TXT) | | `query`† | Domain name subject of the query | | `RA` | Recursion available. True if server supports recursive queries | | `RD` | Recursion desired. True if recursive lookup of query requested | | `rcode` / `rcode_name` | Response code value in the DNS response (e.g. NXDOMAIN, NODATA) | | `rejected` | The DNS query was rejected by the server | | `saw_query` | Whether the full DNS query has been seen | | `saw_reply` | Whether the full DNS reply has been seen | | `TC` | Truncation flag. True if the message was truncated | | `TTLs` | List of TTLs from the answers | | `total_answers` | The total number of resource records in a reply message's answer section | | `total_replies` | The total number of resource records in a reply message's answer, authority, and additional sections | | `trans_id` | 16-bit identifier assigned by DNS client | > **Note**: † Field may contain base64 encoded data if the metadata contains invalid UTF-8 ### HTTP | Field | Description | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accept` | Value of the Accept header in the request, if present, truncated to 256 bytes | | `accept_encoding` | Value of the Accept-Encoding header in the request, if present, truncated to 256 bytes | | [**`cookie`**](#user-content-fn-1)[^1] | Value of the Cookie header, truncated to 256 bytes | | [**`cookie_vars`**](#user-content-fn-1)[^1] | The variables in the cookie field, without the values | | `host` | Value of the Host header, truncated to 256 bytes | | [**`host_multihomed`**](#user-content-fn-1)[^1] | Boolean attribute that indicates whether the address in the host header is observed to be associated with one or multiple IPs | | [**`is_proxied`**](#user-content-fn-1)[^1] | Boolean value indicative of a proxied request | | `ja4h` | The JA4H fingerprint of the HTTP client | | `method` | HTTP Request Method | | [**`orig_ip_bytes`**](#user-content-fn-1)[^1] | Bytes sent by originator to responder | | `orig_mime_types` | Content type header in originator request | | [**`orig_pkts`**](#user-content-fn-1)[^1] | Number of packets sent from originator to responder | | `post_data` | Binary data of the POST request body. Truncated to 2k size | | `proxied` | Value of x-forwarded-for header (e.g. X-FORWARDED-FOR -> 10.10.15.192) | | `referrer` | Value of the Referrer header, truncated to 256 bytes | | `request_body_len` | HTTP payload bytes in request | | [**`request_cache_control`**](#user-content-fn-1)[^1] | Value of the Cache-Control header in the request, if present, truncated to 256 bytes | | [**`request_header_count`**](#user-content-fn-1)[^1] | Count of headers in request | | `resp_filename` | The name of the file returned by the server (if any) | | [**`resp_ip_bytes`**](#user-content-fn-1)[^1] | Bytes send by responder to originator | | `resp_mime_types` | Value of the Content-Type header in response, truncated to 256 bytes | | [**`resp_pkts`**](#user-content-fn-1)[^1] | Number of packets sent from responder to originator | | `response_body_len` | HTTP payload bytes in response | | [**`response_cache_control`**](#user-content-fn-1)[^1] | Value of the Cache-Control header in the response, if present, truncated to 256 bytes | | `response_content_disposition` | Value of the Content-Disposition header (specifies names of the files to be downloaded as attachment, e.g. 'attachment; filename="filename.jpg"'), truncated to 256 bytes | | [**`response_expires`**](#user-content-fn-1)[^1] | Expires header in response, if present | | [**`response_header_count`**](#user-content-fn-1)[^1] | Count of headers in response | | `status_code` | The status code in the HTTP response | | `status_msg` | The status message corresponding to the status code | | `uri` | URI used in the request, truncated to 512 bytes | | `user_agent` | Value of the User-Agent header, truncated to 512 bytes | ### iSession Connectivity | Field | Description | | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | `application` | Applications associated with this session | | `client_luid_proxy` | True if the source address of the connection has been learned as a proxy | | `conn_state` | Connection state. Takes values: S0, S1, SF, REJ, S2, S3, RSTO, RSTR, RSTOS0, RSTRH, SH, SHR, or OTH | | `dir_confidence` | Client/server assignment confidence from 0 to 100 | | `duration` | Duration of connection in ms | | [**`first_orig_resp_data_pkt`**](#user-content-fn-1)[^1] | Base64 encoding of the first 16 bytes of the packet from originator to responder, represented as a string | | [**`first_orig_resp_data_pkt_time`**](#user-content-fn-1)[^1] | Timestamp of first data packet from originator to responder | | [**`first_orig_resp_pkt_time`**](#user-content-fn-1)[^1] | Timestamp of first packet from originator to responder | | [**`first_resp_orig_data_pkt`**](#user-content-fn-1)[^1] | Base64 encoding of the first 16 bytes of the packet from responder to originator, represented as a string | | [**`first_resp_orig_pkt_time`**](#user-content-fn-1)[^1] | Timestamp of first packet from responder to originator | | [**`first_resp_orig_data_pkt_time`**](#user-content-fn-1)[^1] | Timestamp of first data packet from responder to originator | | `ja4lc` | The JA4L fingerprint of the client's light distance | | `ja4ls` | The JA4LS fingerprint of the server's light distance | | `ja4t` | The JA4T fingerprint of the client's TCP SYN packet | | `ja4ts` | The JA4TS fingerprint of the server's TCP SYN ACK packet(s) | | `orig_ip_bytes` | Bytes sent from originator to responder | | `orig_pkts` | Number of packets sent from originator to responder | | [**`orig_vlan_id`**](#user-content-fn-1)[^1] | VLAN\_id of originator, if any | | `proto` | L4 protocol value. 6 is TCP, 17 is UDP | | `protoName` | L4 protocol name (TCP, UDP or ICMP) | | `proxy_to_internal_dst` | True if effective destination after proxy is internal IP | | [**`resp_domain`**](#user-content-fn-1)[^1] | Calculated from TLS SNI, HTTP Host, or the destination IP name (in this exact order) | | `resp_ip_bytes` | Bytes send from responder to originator | | [**`resp_multihomed`**](#user-content-fn-1)[^1] | Boolean attribute that indicates whether the domain is observed to be associated with one or multiple IPs | | `resp_pkts` | Number of packets sent from responder to originator | | [**`resp_vlan_id`**](#user-content-fn-1)[^1] | VLAN\_id of responder, if any | | `service` | Service (e.g. "smb") | | `server_luid_proxy` | True if the destination address of the connection has been learned as a proxy | | `session_start_time` | Timestamp when session started | ### **Connection State Values** | State | Description | | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `S0` | Connection attempt seen, no reply | | `S1` | Connection established, not terminated | | `SF` | Normal establishment and termination. Note that this is the same symbol as for state S1. You can tell the two apart because for S1 there will not be any byte counts in the summary, while for SF there will be | | `REJ` | Connection attempt rejected | | `S2` | Connection established and close attempt by originator seen (but no reply from responder) | | `S3` | Connection established and close attempt by responder seen (but no reply from originator) | | `RSTO` | Connection established, originator aborted (sent a RST) | | `RSTR` | Responder sent a RST | | `RSTOS0` | Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder | | `RSTRH` | Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator | | `SH` | Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open) | | `SHR` | Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator | | `OTH` | No SYN seen, just midstream traffic (one example of this is a "partial connection" that was not later closed) | | | | ### Kerberos | Field | Description | | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `account_privilege` | Privilege level of the account. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9) | | `account_uid` | Account unique identifier (principal\@REALM format) | | `as_rep_padata_count` | Total PA-DATA entries seen on AS-REP prior to truncation | | `as_rep_padata_types` | PA-DATA type integers from AS-REP messages (12 max) | | `as_rep_padata_types_string` | Human readable PA-DATA type names for AS-REP messages (12 max) | | `as_req_padata_count` | Total PA-DATA entries seen on AS-REQ prior to truncation | | `as_req_padata_types` | PA-DATA type integers from AS-REQ messages (12 max) | | `as_req_padata_types_string` | Human readable PA-DATA type names for AS-REQ messages (12 max) | | `client` | Client name, including realm | | `data_source` | The source of the record, either "network" or "log" | | `error_code` | Error code if not a success | | `error_msg` | Error message if not a success | | [**`orig_host_observed_privilege`**](#user-content-fn-1)[^1] | The privilege represents the observed privilege based on the activity of an account seen to operate from the host. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9) | | [**`protocol`**](#user-content-fn-1)[^1] | L4 protocol. 6 (TCP) or 17 (UDP) | | `rep_cipher` | Cipher selected in reply message | | [**`reply_timestamp`**](#user-content-fn-1)[^1] | Timestamp of reply | | `req_ciphers` | Ordered list of requested ciphers | | `request_type` | Type of request (AS or TGT) | | `service` | Service being requested, including realm | | `service_privilege` | Privilege level of the service. The scores can fall in three categories – Low (1, 2), Medium (3, 4, 5, 6, 7) and High (8, 9) | | `service_uid` | Service unique identifier (principal\@REALM format) | | `success` | Whether request was success or not | | `ticket_cipher` | Ticket cipher observed on AS-REP and TGS-REP replies | ### LDAP | Field | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------- | | `attributes` | A set of attributes to request for inclusion in entries that match the search criteria and are returned | | `baseObject` | Base of the subtree in which the search is to be constrained | | `bind_error_count` | If there are bind errors, count of the errors | | `duration` | Duration of the session | | `encrypted_sasl_payload_count` | If sasl encryption is used, the number of encrypted sasl payloads encountered | | `error` | The error message in case of error (e.g. "0000208D: NameErr …") | | `logon_failure_error_count` | The count of logon errors | | `is_close` | Boolean flag indicating whether the close was observed | | `is_query` | Boolean flag indicating whether the query was observed in the request | | `matched_dn` | The matched distinguished name | | `message_id` | Message id | | `query` | Criteria to use to identify which entries within the scope should be returned | | `query_scope` | The portion of the target subtree that should be considered (e.g. wholeSubtree) | | `response_bytes` | Number of bytes in the response | | `result` | The result of the query in this request | | `request_bytes` | Number of bytes in the request | | `result_code` | The result code (success or failure) in the response | | `result_count` | The count of the entries in the result | ### Match (Alert/IDS Data) | Field | Description | | -------------------------------------------- | ---------------------------------------------------------------------------- | | `eve_json.alert.category` | Category of the Alert Message | | `eve_json.alert.gid` | Unique identifier for group of signatures. Defaults to 1 for most signatures | | `eve_json.alert.metadata.affected_product` | Specifies details on the affected product | | `eve_json.alert.metadata.attack_target` | Specifies if the attack target is the Client, Server, Both, or Other | | `eve_json.alert.metadata.created_at` | Specifies the date the signature was created | | `eve_json.alert.metadata.deployment` | Specifies where the signature should be deployed | | `eve_json.alert.metadata.malware_family` | Specifies the Malware Family that is associated with the signature | | `eve_json.alert.metadata.policy` | Specifies details on the alert policy | | `eve_json.alert.metadata.signature_severity` | Describes the severity associated with the signature | | `eve_json.alert.metadata.tag` | Specifies any tag information assigned to the signature by the author | | `eve_json.alert.metadata.updated_at` | Specifies the data of the last update to the signature | | `eve_json.alert.rev` | Alert signature revision number indicating if the signature has been updated | | `eve_json.alert.rule` | Specifies the rule that fired the alert | | `eve_json.alert.severity` | Number representing the severity of the alert | | `eve_json.alert.signature` | The rule name. Based on the 'msg' text in the signature | | `eve_json.alert.signature_id` | Alert signature Identifier | | `eve_json.alert.xff` | Value of x-forwarded-for | | `eve_json.direction` | Specifies the traffic direction of the alert | | `eve_json.packet` | Specifies the packet that triggered the signature | | `eve_json.payload` | Provides the Base64 Encoded packet payload information | | `eve_json.payload_printable` | Provides the payload presented in ASCII | | `eve_json.proto` | L4 protocol name | ### NTLM | Field | Description | | ---------- | ----------------------------------------- | | `domain` | Domain of the host | | `hostname` | Hostname on which the user logged in | | `status` | Status code in response | | `success` | Whether the request was successful or not | | `username` | Username or account name that logged in | ### Radius | Field | Description | | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `account_authentic` | Identifies how the user was authenticated | | `account_delay_time` | Identifies how long the sender has been trying to send the message for | | `account_input_gigawords` | Identifies how many times the Acct-Input counter has rolled over for input | | `account_input_octets` | How many bytes have been received | | `account_input_packets` | How many packets the system has received | | `account_output_gigawords` | Identifies how many times the Acct-Input counter has rolled over for output | | `account_output_octets` | How many bytes have been set | | `account_output_packets` | How many packets the system has sent | | `account_session_id` | This is a unique ID that identifies the RADIUS Accounting Session which is sent in a separate packet | | `account_session_time` | Duration of service received by user | | `calling_station_id` | This is the identifier of the calling station | | `connect_info` | Identify the speed of the connection or other connection related information | | `delegated_ipv6_prefix` | IPv6 Pool from which the IPv6 address was assigned | | `dst_display_name` | DNS Name of the Destination | | `dst_host_luid` | This is the ID of the destination host with host ID | | `dst_luid` | The LUID of the RADIUS Server | | `dst_luid_external` | Value is True if the destination is external | | `event_timestamp` | Similar to ts but is the timestamp from the device, not from Vectra | | `filter_id` | This identifies any ACL that is in use | | `framed_address` | This field is available in the request that identifies the endpoint requesting authentication | | `framed_interface` | Identifies the interface used when the user connects to the system | | `framed_ip_address` | IP address of the endpoint device connecting to the system | | `framed_ipv6_prefix` | Indicates the framed IPv6 prefix for the user | | `framed_protocol` | Identifies the Framed Protocol used when the user connects to the system | | `idle_timeout` | Amount of time a session can be idle before it is disconnected | | `logged` | The boolean attribute indicates if the request was previously logged | | `mac` | MAC Address if observed as a field in the Radius message | | `nas_identifier` | Identifies the role the authenticating client is requesting | | `nas_ip_address` | This is an IP Address format, it can be the IP of the Device, the Endpoint, or Intermediate system, depending on implementation | | `nas_port` | Physical Port Number of the Device Authenticating the User | | `nas_port_id` | Text string identifying the port provided by the client | | `nas_port_type` | This is the type of medium of the port (e.g. Ethernet, Wifi \&c.) | | `password_seen` | Boolean attribute indicating password was seen | | `radius_type` | The value indicates if it is an access or accounting request | | `reply_msg` | Reply message from the server challenge. This is frequently shown to the user authenticating | | `reply_timestamp` | Timestamp when the reply message was received | | `result` | Success or Failed Authentication | | `service_type` | Type of service the user has requested | | `session_timeout` | This is the maximum session length | | `src_display_name` | DNS Name of the Source | | `src_host_luid` | This is the ID of the Src with Host ID | | `src_luid` | The LUID of the RADIUS Client | | `src_luid_external` | Value is True if the source is external | | `ttl` | The duration between the first request and either the "AccessAccept" message or an error. If the field is empty, it means that either the request or response was not seen | | `tunnel_client` | Address (IPv4, IPv6, or FQDN) of the initiator end of the tunnel, if present. This is collected from the Tunnel-Client-Endpoint attribute | | `username` | This is the username if observed in the Radius message | ### RDP | Field | Description | | ----------------------- | -------------------------------------------------------------------------------------------------------------------- | | `client_build` | RDP client version used by client machine. Will be "unknown" if encrypted | | `client_dig_product_id` | Product ID of the client machine | | `client_name` | Hostname of the client machine. | | `cookie` | Cookie value used by the client. Generally represents the username. It could be truncated by the client application. | | `desktop_height` | Desktop height of client machine. 0 if encrypted | | `desktop_width` | Desktop width of client machine. 0 if encrypted | | `keyboard_layout` | Keyboard layout (language) of client machine (e.g. "US" "Encrypted Keyboard Layout") | | `result` | If encrypted, result value is "encrypted" otherwise it will be empty | ### SMB Files | Field | Description | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | `action` | Action taken on file | | [**`delete_on_close`**](#user-content-fn-1)[^1] | Flag indicating if the delete\_on\_close attribute is enabled. If enabled, a file close action may delete the file if it is the last close on the file | | [**`domain`**](#user-content-fn-1)[^1] | Domain of the SMB server | | [**`hostname`**](#user-content-fn-1)[^1] | Hostname of the SMB client | | `path` | Path pulled from the tree this file was transferred to or from | | `prev_name` | If the rename action was seen, this will be the file's previous name | | `name` | Filename if one was seen | | [**`username`**](#user-content-fn-1)[^1] | Username or account name that logged in. Names ending in '$' are machine names (not user account names) | | `version` | SMB version (SMBv1 or SMBv2) | ### SMB Mapping | Field | Description | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | | [**`domain`**](#user-content-fn-1)[^1] | Domain of the SMB server | | [**`hostname`**](#user-content-fn-1)[^1] | Hostname of the SMB client | | `path` | Name of the tree path | | `service` | Type of re-originator of the tree | | [**`username`**](#user-content-fn-1)[^1] | Username or account name that logged in. Names ending in '$' are machine names (not user account names) | | `version` | SMB version (SMBv1 or SMBv2) | ### SMTP | Field | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `cc` | Contents of the CC header, formatted as a comma separated list | | `date` | Contents of the Date header | | `dkim_status` | pass/fail/none. Based on the 'Authentication-results' header | | `dmarc_status` | pass/fail/none. Based on the 'Authentication-results' header | | `first_received` | Contents of the first Received header, which signifies the first SMTP server to receive this message, (i.e. sending server) | | `from` | Contents of the From header | | `helo` | Contents of the Helo header | | `in_reply_to` | Contents of the In-Reply-To header | | `mail_from` | Email addresses found in the From header | | `msgid` | Contents of the MsgID header | | `rcpt_to` | Email addresses found in the Rcpt header, formatted as a comma separated list | | `reply_to` | Contents of the ReplyTo header | | `second_received` | Contents of the second Received header, which signifies the second SMTP server to receive this message | | `subject` | Contents of the Subject header | | `spf_helo_status` | Based on the 'Received-SPF' header in smtp. This header specifies the SPF status (Sender Policy Framework). One of pass/fail/neutral/softfail/none/temperror/permerror. See: | | `spf_mailfrom_status` | One of pass/fail/neutral/softfail/none/temperror/permerror | | `tls` | Indicates that the connection has switched to using TLS | | `to` | Contents of the To header, formatted as a comma separated list | | `user_agent` | Value of the User-Agent header from the client | | `x_originating_ip` | Contents of the X-Originating-IP header | ### SSH | Field | Description | | ----------------- | --------------------------------------------------------- | | `client` | The client's version string | | `cipher_alg` | The encryption algorithm in use | | `compression_alg` | The compression algorithm in use | | `hassh` | hassh hash of client based on client SSH parameters | | `hasshServer` | haashServer hash of server based on client SSH parameters | | `host_key` | The server's key fingerprint | | `host_key_alg` | The server host key's algorithm | | `kex_alg` | The key exchange algorithm in use | | `mac_alg` | The signing (MAC) algorithm in use | | `server` | The server's version string | | `version` | SSH major version (1 or 2) | ### SSL | Field | Description | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | | `application` | Applications associated with this session | | `cipher` | SSL/TLS cipher suite chosen from server | | [**`client_curve_num`**](#user-content-fn-1)[^1] | Elliptical curve number sent by the client | | [**`client_ec_point_format`**](#user-content-fn-1)[^1] | Elliptical curve point format offered by the client | | [**`client_extension`**](#user-content-fn-1)[^1] | Client extensions | | `client_issuer` | Client cert issuer | | `client_luid_proxy` | True if the source address of the connection has been learned as a proxy | | `client_subject` | Client cert subject | | [**`client_version`**](#user-content-fn-1)[^1] | SSL version string sent by the client | | [**`client_version_num`**](#user-content-fn-1)[^1] | SSL version number sent by the client | | `curve` | Elliptical curve number for ECDHE | | `established` | Flag to indicate if this ssl session has been established successfully, or if it was aborted during the handshake | | `issuer` | Server cert issuer | | `ja3` | JA3 hash of client based on client SSL parameters | | `ja3s` | JA3S hash of server based on server SSL parameters | | `ja4` | The JA4 fingerprint of the TLS client | | `ja4s` | The JA4S fingerprint of the TLS server response | | `next_protocol` | Next protocol the server chose using the application layer next protocol extension, if present | | `proxy_to_internal_dst` | True if effective destination after proxy is internal ip | | `server_extensions` | Server extensions | | `server_luid_proxy` | True if the destination address of the connection has been learned as a proxy | | `server_name` | SNI value | | `subject` | Server cert subject | | `version` | SSL/TLS version that the server chose | | `version_num` | Numeric SSL/TLS version that the server chose | ### X509 | Field | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `application` | Applications associated with this session | | `basic_constraints.ca` | Flag indicating whether the subject of the certificate is a CA | | `basic_constraints.path_len` | Maximum depth of valid certification paths that include this certificate | | `certificate.cn` | Common name that identifies the host name of the certificate | | `certificate.curve` | Curve, if EC-certificate | | `certificate.exponent` | Key exponent | | `certificate.issuer` | Combination of country, organizations, common name, issuer, URI | | `certificate.key_alg` | Name of the public key algorithm that is used in data transmission, e.g. RSA encryption | | `certificate.key_length` | Number of bits used in the encryption, e.g. 2,048-bit encryption | | `certificate.key_type` | Three key types, depending upon the key algorithm | | `certificate.not_valid_after` | Time after the certificate is invalid | | `certificate.not_valid_before` | Time before the certificate is invalid | | `certificate.self_issued` | Boolean flag indicating whether the certificate is self-issued or backed by a CA | | `certificate.serial` | Unique serial number given by certificate authority or certificate signed authority. Usually 40 hexadecimal characters | | `certificate.sig_alg` | Name of the signature algorithm | | `certificate.subject` | Owner of the certificate (distinguished name) | | `certificate.version` | Version of the server certificate (SSL V3, TLS 1.0, TLS 1.1, etc.) | | `client_luid_proxy` | True if the source address of the connection has been learned as a proxy | | `ja4x` | The JA4X fingerprint of the X.509 TLS certificate | | `proxy_to_internal_dst` | True if effective destination after proxy is internal ip | | `san.dns` | Specifying a list of additional host names for a single certificate along with DNS names that are associated with SAN (Subject Alternative Name) | | `san.email` | Email address associated with the SAN | | `san.ip` | IP address of the SAN in the digital certificate | | `san.other_fields` | Other fields in the SAN | | `san.uri` | URL name associated with SAN | | `server_luid_proxy` | True if the destination address of the connection has been learned as a proxy | [^1]: Unique to Vectra AI, not in standard Zeek output. [^2]: Beacon metadata is uniquely computed by Vectra AI platform, not in standard Zeek output. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.vectra.ai/reference/metadata-attributes/vectra-ai-platform-network-metadata-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.