Match Fields Reference

This topic is a reference to the Record fields that a Match List with a given Target Column will be compared to. Each header below—Hostname, Domain, Username, and—is a supported Target Column for a Cloud SIEM Match List. The items listed below each header are Record fields 

If a Record contains a field whose name matches one of the match fields for a Target Column, the name of the Match List, Cloud SIEM will append the Match List name to the Record in the list_matches array. 

Hostname

• device_hostname
• dstDevice_hostname
• srcDevice_hostname
• http_hostname
• http_referrerHostname
• bro_ssl_serverName

Domain

• bro_ntlm_domainame
• bro_ssl_serverName_rootDomain
• dns_queryDomain
• dns_replyDomain
• fromUser_authDomain
• http_referrerDomain
• http_url_rootDomain
• http_url_fqdn

Username

• username
• fromUser_username
• user_username

File Hash

• file_hash_md5
• file_hash_sha1
• file_hash_sha256
• file_hash_ssdeep
• file_hash_imphash
• file_hash_pehash

URL

• http_url

IP Address

• srcDevice_ip
• srcDevice_natIp
• bro_dhcp_assignedIp
• bro_smtp_headers.xOriginatingIp
• bro_socks_boundIp
• device_ip
• device_natIp
• dstDevice_ip
• dstDevice_natIp
• bro_radius_remoteIp
• bro_socks_requestIp
• dns_replyIp

Source IP Address

• srcDevice_ip
• srcDevice_natIp
• bro_dhcp_assignedIp
• bro_smtp_headers.xOriginatingIp
• bro_socks_boundIp
• device_ip
• device_natIp

Destination IP Address

• dstDevice_ip
• dstDevice_natIp
• bro_radius_remoteIp
• bro_socks_requestIp
• dns_replyIp

IP ASN

• srcDevice_ip_asnNumber
• srcDevice_natIp_asnNumber
• bro_dhcp_assignedIp_asnNumber
• bro_smtp_headers.xOriginatingIp_asnNumber
• bro_socks_boundIp_asnNumber
• device_ip_asnNumber
• device_natIp_asnNumber
• dstDevice_ip_asnNumber
• dstDevice_natIp_asnNumber
• bro_radius_remoteIp_asnNumber
• bro_socks_requestIp_asnNumber
• dns_replyIp_asnNumber

Source IP ASN

• srcDevice_ip_asnNumber
• srcDevice_natIp_asnNumber
• bro_dhcp_assignedIp_asnNumber
• bro_smtp_headers.xOriginatingIp_asnNumber
• bro_socks_boundIp_asnNumber
• device_ip_asnNumber
• device_natIp_asnNumber

Destination IP ASN

• dstDevice_ip_asnNumber
• dstDevice_natIp_asnNumber
• bro_radius_remoteIp_asnNumber
• bro_socks_requestIp_asnNumber
• dns_replyIp_asnNumber

IP ISP

• srcDevice_ip_isp
• srcDevice_natIp_isp
• bro_dhcp_assignedIp_isp
• bro_smtp_headers.xOriginatingIp_isp
• bro_socks_boundIp_isp
• device_ip_isp
• device_natIp_isp
• dstDevice_ip_isp
• dstDevice_natIp_isp
• bro_radius_remoteIp_isp
• bro_socks_requestIp_isp
• dns_replyIp_isp

Source IP ISP

• srcDevice_ip_isp
• srcDevice_natIp_isp
• bro_dhcp_assignedIp_isp
• bro_smtp_headers.xOriginatingIp_isp
• bro_socks_boundIp_isp
• device_ip_isp
• device_natIp_isp

Destination IP ISP

• dstDevice_ip_isp
• dstDevice_natIp_isp
• bro_radius_remoteIp_isp
• bro_socks_requestIp_isp
• dns_replyIp_isp

IP Organization

• srcDevice_ip_asnOrg
• srcDevice_natIp_asnOrg
• bro_dhcp_assignedIp_asnOrg
• bro_smtp_headers.xOriginatingIp_asnOrg
• bro_socks_boundIp_asnOrg
• device_ip_asnOrg
• device_natIp_asnOrg
• dstDevice_ip_asnOrg
• dstDevice_natIp_asnOrg
• bro_radius_remoteIp_asnOrg
• bro_socks_requestIp_asnOrg
• dns_replyIp_asnOrg

Source IP Organization

• srcDevice_ip_asnOrg
• srcDevice_natIp_asnOrg
• bro_dhcp_assignedIp_asnOrg
• bro_smtp_headers.xOriginatingIp_asnOrg
• bro_socks_boundIp_asnOrg
• device_ip_asnOrg
• device_natIp_asnOrg

Destination IP Organization

• dstDevice_ip_asnOrg
• dstDevice_natIp_asnOrg
• bro_radius_remoteIp_asnOrg
• bro_socks_requestIp_asnOrg
• dns_replyIp_asnOrg