xenXDRby FluenceSecurity
Book a demo

Field dictionary

Every canonical field name, its type and meaning.

Last updated 2026-09-15

Every field in XenXDR has one canonical name: dotted, ECS-compatible, and the same everywhere. It is the name you type in the Logs query bar, the name imported Sigma rules compile to, and the name dashboards and detections refer to. One name answers across sources: file.path is the file an event acted on whether the event came from Sysmon, Microsoft Defender or auditd.

Typing a field name

Dotted names are a tree, and the query bar completes them like one: what it offers first is always the next dot part, so a name widens a hop at a time and you never have to remember the whole path.

text
pro → process.  →  process.par → process.parent.  →  process.parent.exe
→ process.parent.executable

An offer ending in a dot is a branch — accepting it walks down a level and shows what is under it, with the full names offered underneath so nothing is hidden behind a group. Completed parts also match by prefix, so pro.par finds the same branch.

Every field additionally answers to a shorthand: the initials of its parts. Type it bare, or prefix it with ; to search only the shorthands when the same letters also begin a real name.

FieldShorthand
host.name;hn, ;hname
event.module;em, ;emodule
event.type;et, ;etype
event.severity;es, ;eseverity
user.name;un, ;uname
process.executable;pe, ;pexecutable
process.parent.executable;ppe, ;ppexecutable
process.command_line;pc, ;pcl, ;pcommand_line
file.path;fp, ;fpath
user.target.name;utn, ;utname
user.audit.id;uai, ;uaid
event.outcome;eo, ;eoutcome
threat.name;tn, ;tname
powershell.script_block_text;ps, ;psbt, ;pscript_block_text
amsi.content;ac, ;acontent
threat.indicator.value;tiv, ;tivalue
rule.onhost.id;roi, ;roid
auditd.key;ak, ;akey
auditd.syscall.name;asn, ;asname

Collisions are not resolved silently — ;ppe is both process.parent.executable and process.parent.entity_id, and both are offered, the more used one first. A handful of spellings analysts already say out loud are mapped by hand: ;cmd → process.command_line · ;cli → process.command_line · ;pcmd → process.parent.command_line · ;exe → process.executable · ;img → process.executable · ;pexe → process.parent.executable · ;cwd → process.working_directory · ;sip → source.ip · ;dip → destination.ip · ;sport → source.port · ;dport → destination.port · ;host → host.name · ;user → user.name · ;sev → event.severity · ;evt → event.type · ;mod → event.module · ;code → event.code · ;msg → message · ;sha256 → file.hash.sha256 · ;url → url.original · ;chan → winlog.channel.

Fields

FieldTypePropertiesDescription
host.namestringcase-insensitive, groupableHostname the event originated from
e.g. WKS-0412
agent.idstringcase-insensitive, groupableXenXDR agent id of the reporting endpoint
observer.vendorstringcase-insensitiveWho made the event: microsoft, fortinet, okta, …
e.g. microsoft
observer.productstringcase-insensitiveWhich product emitted it: sysmon, defender, fortigate, entra, …
e.g. sysmon
event.modulestringcase-insensitiveTelemetry stream the console filters on: sysmon, defender, security, powershell, firewall, auditd, syslog, http, hec, …
e.g. sysmon
event.datasetstringcase-insensitiveStream within the product: sysmon, cef, syslog, a HEC sourcetype
e.g. cef
event.typestringcase-insensitiveNormalised event verb, the same across sources, and what rules target
e.g. process_create
event.codenumberNative event id (Windows 4625, Sysmon 1, …)
e.g. 4625
event.severitystringcase-insensitiveTriage hint assigned at ingest: info, low, medium, high, critical
e.g. high
user.namestringcase-insensitive, groupableAccount associated with the event; the actor, where user.target.name is the account acted on
e.g. j.doe
source.ipstringgroupableNormalized source address
e.g. 10.0.0.99
source.portnumberNormalized source port
destination.ipstringgroupableNormalized destination address
e.g. 203.0.113.10
destination.portnumberNormalized destination port
e.g. 443
url.originalstringcase-insensitive, groupableURL / DNS query / request target
e.g. evil.example.com
process.executablestringcase-insensitive, groupableFull path of the executing image
e.g. C:\Windows\System32\powershell.exe
process.entity_idstringgroupableStable process identity, what the process tree is keyed on
e.g. a1b2c3d4-0001-6001-ab00-000000001700
process.pidnumberProcess id
process.parent.entity_idstringgroupableParent process identity on process_create; the opened target on process_access
process.parent.executablestringcase-insensitiveParent process image path
e.g. C:\Windows\explorer.exe
process.parent.pidnumberParent process id at creation time
file.hash.sha256stringgroupableSHA256 when the source provides one
messagestringcase-insensitiveHuman-readable event message
e.g. An account failed to log on.
fieldsmapEvery field the source emitted that has no canonical name, under the source’s own key
rawstringOriginal event document, kept verbatim for forensics
winlog.channelstringcase-insensitiveWindows Event Log channel
e.g. Microsoft-Windows-Sysmon/Operational
winlog.providerstringcase-insensitiveEvent provider name
e.g. Microsoft-Windows-Security-Auditing
log.file.pathstringcase-insensitivePath of the file a log line was read from
e.g. /var/log/auth.log
log.syslog.facilitystringcase-insensitiveSyslog facility the device logged under
e.g. auth
log.syslog.appnamestringcase-insensitiveSyslog APP-NAME (RFC 5424) or the tag ahead of the colon
e.g. sshd
log.syslog.procidstringSyslog PROCID; the sender’s pid, as text, exactly as it wrote it
splunk.sourcetypestringcase-insensitiveSplunk sourcetype from a HEC envelope
e.g. cisco:asa
process.command_linestringcase-insensitiveFull process command line; Sysmon 1, Security 4688, or reconstructed from the auditd EXECVE record
e.g. powershell -enc SQBFAFgA…
process.parent.command_linestringcase-insensitiveParent process command line
process.namestringcase-insensitiveShort command name as the kernel sees it (auditd comm=); the basename, where process.executable is the full path
e.g. sh
process.titlestringcase-insensitiveKernel-truncated argv; the fallback when no EXECVE record exists
process.working_directorystringcase-insensitiveWorking directory at process start (Sysmon) or at the syscall (auditd)
process.integrity_levelstringcase-insensitiveProcess integrity level
e.g. High
process.args_countnumberArgument count on the execve (auditd EXECVE argc=)
e.g. 3
process.creator.entity_idstringProcess that actually requested this creation, as the kernel reports it; differs from the parent exactly when a PPID was spoofed
e.g. a1b2c3d4-0001-6001-ab00-000000001700
process.creator.pidnumberPid of the creating process, where the reported parent may be a forgery
e.g. 4
process.creator.executablestringcase-insensitiveImage of the process that actually requested the creation; recorded only when it differs from the parent, where absent means “the same as the parent”
e.g. C:\Windows\System32\svchost.exe
process.creator.mismatchbooleanTrue when the creating process is not the reported parent; the observation a PPID spoof cannot hide, and not on its own a verdict
e.g. true
process.creator.brokerbooleanTrue when a creator mismatch is known-legitimate re-parenting rather than a spoof
e.g. true
process.creator.resolvedbooleanFalse when the creating process could only be identified by pid
e.g. false
process.start_keystringProcess start key, unique for the life of a boot, unlike a pid
e.g. 91000
process.parent.start_keystringStart key of the reported parent, so a parent edge can be checked against pid reuse
e.g. 70000
process.exit_codestringExit code the process ended with, as the kernel reports it
e.g. 0
process.exit_signalstringSignal that ended the process, when one did
e.g. SIGKILL
process.parent.attestedbooleanTrue when the parent relationship is confirmed by the operating system at process start
e.g. true
process.args_truncatedbooleanTrue when the command line was too long to record in full
e.g. true
process.executable_partialbooleanTrue when the full executable path could not be resolved
e.g. true
winlog.process.granted_accessstringcase-insensitiveAccess mask the opener requested, as Sysmon 10 logs it; hex text, so bit tests need winlog.process.create_access
e.g. 0x1010
winlog.process.create_accessbooleancase-insensitiveTrue when Sysmon 10’s access mask carries PROCESS_CREATE_PROCESS (0x0080); precomputed at ingest because a rule cannot bit-test a hex string
e.g. true
file.pathstringcase-insensitiveFile the event acted on; Sysmon 11 TargetFilename, Defender’s Path, or the auditd PATH record
e.g. /etc/shadow
file.pathsstringcase-insensitiveEvery path the syscall resolved, in order
file.modestringMode bits of the touched file
e.g. 0100755
file.inodestringInode of the touched file; tells a rewrite from a replace
file.owner.idstringOwning uid of the touched file (auditd PATH ouid=)
e.g. 0
file.share.namestringcase-insensitiveSMB share the event touched (5140/5145)
e.g. \\*\ADMIN$
dll.pathstringcase-insensitiveDLL/image loaded (Sysmon 7)
dll.code_signature.signedbooleancase-insensitiveImage signature status (Sysmon 7)
e.g. true
registry.pathstringcase-insensitiveRegistry key/value written (Sysmon 13)
destination.domainstringcase-insensitiveResolved destination host
network.transportstringcase-insensitiveTransport protocol
e.g. tcp
network.typestringcase-insensitiveSocket family the connect targeted: ipv4, ipv6, unix
network.socket.pathstringcase-insensitiveUnix socket path for ipc_connect events
dns.answersstringcase-insensitiveDNS answers (Sysmon 22)
network.directionstringcase-insensitiveWhich way the flow went: inbound, outbound, or internal
e.g. outbound
network.bytes_sentnumberBytes the endpoint sent on this flow; the beacon-vs-exfil discriminator, which a firewall log cannot attribute to a process
e.g. 4096
network.bytes_receivednumberBytes the endpoint received on this flow
e.g. 182000
network.packetsnumberPackets counted on the flow
e.g. 210
event.duration_msnumberHow long the observed operation or flow lasted, in milliseconds
e.g. 61000
user.target.namestringcase-insensitiveAccount the event acted on: the logon target, the auditd acct=, the identity sudo was asked to assume
e.g. Administrator
user.effective.namestringcase-insensitiveAccount that opened the session on the target’s behalf (PAM “by <user>”)
e.g. j.doe
user.full_namestringcase-insensitiveDisplay name of the acting account (Okta/Entra)
e.g. Jane Doe
user.typestringcase-insensitiveWhat kind of principal acted: User, SystemPrincipal, Application
e.g. User
user_agent.originalstringcase-insensitiveUser-agent string the client sent
e.g. Mozilla/5.0 …
source.geo.namestringcase-insensitiveWhere the provider geolocated the source address
e.g. Warsaw, PL
user.domainstringcase-insensitiveDomain of the target account
user.idstringEffective-at-syscall user id (numeric unless auditd runs ENRICHED)
user.group.idstringGroup id at the syscall
user.effective.idstringEffective uid; differs from user.id exactly when something setuid ran
e.g. 0
user.effective.group.idstringEffective group id at the syscall
user.audit.idstringLogin uid; survives su/sudo, so it names who is really acting
e.g. 1000
winlog.session_idstringWindows session the process runs in; 0 is services, 1 the console user; a service-session process spawning an interactive one is worth a look
e.g. 1
winlog.logon.typenumberWindows logon type: 2 interactive, 3 network, 10 RDP…
e.g. 10
winlog.logon.idstringcase-insensitiveLogon id of the session created; joins a logon to everything done inside it
e.g. 0x3e7
winlog.logon.subject_idstringcase-insensitiveLogon id of the session that requested the operation
winlog.logon.processstringcase-insensitiveLogon process that handled the authentication
e.g. Advapi
winlog.logon.authentication_packagestringcase-insensitiveAuth package (NTLM, Kerberos…)
winlog.logon.workstationstringcase-insensitiveWorkstation the logon came from
winlog.kerberos.ticket_encryptionstringcase-insensitiveKerberos ticket encryption type (4769); 0x17 is RC4, what Kerberoasting downgrades to
e.g. 0x17
winlog.privilegesstringcase-insensitivePrivileges assigned or exercised (4672/4673)
e.g. SeDebugPrivilege
winlog.statusstringcase-insensitiveNT status code of the operation
e.g. 0xc000006d
event.outcomestringcase-insensitiveWhether the operation succeeded; auditd success= on a syscall, res= on a USER_/CRED_ record, the Okta/Entra result
e.g. yes
event.reasonstringcase-insensitiveWhy the operation ended the way it did, in the provider’s words
e.g. Invalid username or password
event.idstringThe provider’s own unique id for this event; distinct from event.code, which is the numeric kind of event
e.g. 9f1c…
event.actionstringcase-insensitiveRemediation action the product took (Defender)
e.g. Quarantine
threat.namestringcase-insensitiveDefender detection name
e.g. Trojan:Win32/Wacatac.B!ml
threat.categorystringcase-insensitiveDefender threat category
service.namestringcase-insensitiveService installed/changed (7045/4697)
service.executablestringcase-insensitiveService binary path (7045)
service.unitstringcase-insensitivesystemd unit the audit record names
e.g. sshd.service
device.instance_idstringcase-insensitiveDevice instance id of an arriving device (Kernel-PnP)
e.g. USBSTOR\Disk&Ven_Kingston&Prod_DataTraveler\0019E06B1234&0
device.driverstringDriver or service that claimed the arriving device
device.classstringDevice setup class of an arriving device
e.g. DiskDrive
device.storagebooleantrue when the arriving device is mass storage; the removable-media question an MDR is asked
device.portstringUSB bus port the device enumerated on (Linux kernel line)
e.g. 1-1.4
device.vendorstringUSB idVendor of an arriving device, as the kernel printed it
e.g. 0951
device.productstringUSB idProduct of an arriving device, as the kernel printed it
e.g. 1666
service.start_typestringStart type a service now has (SCM 7045/7040)
e.g. auto start
service.start_type_oldstringStart type the service had before a 7040 change
service.accountstringcase-insensitiveAccount a newly installed service runs as
e.g. LocalSystem
winlog.task_namestringcase-insensitiveScheduled task registered/updated (106/140)
powershell.script_block_textstringcase-insensitiveLogged PowerShell script block (4104)
entra.applicationstringcase-insensitiveApplication the sign-in was for
e.g. Office 365 Exchange Online
entra.client_appstringcase-insensitiveClient app type the sign-in used; legacy protocols show up here
e.g. Browser
entra.categorystringcase-insensitiveDirectory-audit category as Entra names it
e.g. UserManagement
dns.question.typestringcase-insensitiveRecord type asked for: A, AAAA, CNAME, TXT…
e.g. AAAA
dns.response_codestringcase-insensitiveAnswer status: NOERROR, NXDOMAIN, SERVFAIL, REFUSED, TIMEOUT
e.g. NXDOMAIN
dns.answers.cnamestringcase-insensitiveCNAME aliases in the answer, apart from the addresses so a rule on dns.answers matches addresses only
dns.serverstringResolver the query went to (Windows DNS-Client ServerList)
dns.idstringTransaction id of the DNS message, joining a query to its answer
dns.partialbooleanTrue when the DNS answer was recorded in part
network.flow.statestringcase-insensitiveopen for a minute record of a connection still up, closed for its last
e.g. closed
network.flow.continuedbooleanTrue on every flow record after the first for the same connection; the counters are deltas, so summing them gives the total
network.flow.bytes_totalbooleanTrue when the byte counts are the connection’s lifetime totals
file.target_pathstringcase-insensitiveNew path of a rename or link
e.g. C:\Users\j.doe\Downloads\payload.exe
file.extensionstringcase-insensitiveExtension of the file acted on, without the dot
e.g. vbs
file.extension_changedbooleanTrue when a rename changed the extension; the staging move (payload.txt → payload.exe)
file.namestringcase-insensitiveBase name of the file acted on
e.g. update.vbs
file.directorystringcase-insensitiveDirectory of the file acted on
file.alternate_streambooleanTrue when the path names an NTFS alternate data stream; a write no directory listing shows
file.write_bytesnumberBytes of the first write on the handle in the minute the record covers
file.truncatedbooleanTrue when the open truncated the file (O_TRUNC)
file.path_partialbooleanTrue when the path is relative to its filesystem rather than absolute
file.path_truncatedbooleanTrue when the path was too long to record in full
registry.keystringcase-insensitiveKey of a registry write, without the value name
e.g. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
registry.valuestringcase-insensitiveValue name of a registry write
e.g. Updater
registry.datastringcase-insensitiveData written, as the provider rendered it, capped at 512 bytes
registry.data_typestringcase-insensitiveREG_* type of the value written
e.g. REG_SZ
registry.data_truncatedbooleanTrue when registry.data was cut at the cap
registry.hivestringcase-insensitiveHKLM or HKU
e.g. HKLM
registry.path_partialbooleanTrue when the key could be named only relative to its parent object
dll.basestringLoad address of the image
dll.sizestringMapped size of the image
dll.checksumstringPE checksum of the image, from the loader
dll.timestampstringPE link timestamp of the image
dll.unusual_pathbooleanTrue when the image loaded from outside the system and program directories
amsi.appstringcase-insensitiveApplication that submitted content to AMSI (the PowerShell host, WSH, VBA…)
amsi.contentstringcase-insensitiveScript content as the AMSI provider scanned it; after deobfuscation, capped at 8 KB
amsi.content_namestringcase-insensitiveName or path AMSI was given for the content
amsi.content_sizenumberBytes the scanner was handed
amsi.resultstringcase-insensitiveScanner verdict: clean, not_detected, blocked_by_admin, detected
e.g. detected
amsi.hashstringContent hash AMSI reported
amsi.content_truncatedbooleanTrue when amsi.content is partial
powershell.script_block_idstringId joining the chunks of one script block
powershell.message_numbernumberChunk number of a script block
powershell.message_totalnumberChunk count of a script block
powershell.suspiciousbooleanTrue when PowerShell’s own suspicious-content list matched the block (logged at Warning whether or not Script Block Logging is on)
powershell.script_block_truncatedbooleanTrue when the block text is partial
powershell.commandstringcase-insensitivePowerShell pipeline execution details (4103)
powershell.command_truncatedbooleanTrue when powershell.command was cut
wmi.namespacestringcase-insensitiveWMI namespace of the operation or subscription
e.g. //./root/subscription
wmi.filterstringcase-insensitiveEvent filter (ESS) of a permanent subscription
wmi.consumerstringcase-insensitiveConsumer of a permanent subscription; what runs when the filter fires
e.g. CommandLineEventConsumer.Name="Updater"
wmi.possible_causestringcase-insensitiveWMI-Activity’s own note on a subscription event
wmi.operationstringcase-insensitiveThe WMI operation, as the Trace channel spells it
e.g. Start IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
wmi.client_machinestringcase-insensitiveMachine the WMI client called from; not this host means lateral movement
winlog.task_actionstringcase-insensitiveExecutable a scheduled task launched (129)
process.working_directory_partialbooleanTrue when the working directory could not be resolved in full
process.target.pidnumberPid a ptrace attached to
process.target.entity_idstringIdentity of the process a ptrace attached to
process.target.executablestringcase-insensitiveImage of the process a ptrace attached to
process.target.namestringcase-insensitiveCommand name of a ptrace target that could not be named by image
process.ptrace.modestringPTRACE_MODE_* bits of the access check
module.namestringcase-insensitiveKernel module requested or loaded
e.g. rootkit
bpf.cmdstringbpf(2) command number (5 = BPF_PROG_LOAD)
kexec.syscallstringkexec_load or kexec_file_load
kexec.flagsstringFlags passed to kexec
container.idstringContainer the process belongs to, from its cgroup
e.g. 3f1c2b5a9d8e
container.runtimestringcase-insensitiveRuntime that owns the container: docker, containerd, cri-o, podman, kubernetes
process.hash.sha256stringSHA256 of the process image, used for indicator matching
threat.indicator.typestringcase-insensitiveWhat matched an indicator: hash, ip or domain
threat.indicator.valuestringcase-insensitiveThe indicator that matched
threat.indicator.revstringRevision of the indicator set the match was made against
rule.onhost.idstringcase-insensitiveOn-host rule that fired
e.g. shadow-copy-delete
rule.onhost.responsestringcase-insensitiveResponse the rule took: alert or alert+kill
rule.onhost.versionstringVersion of the fixed rule list the agent carries
rule.onhost.killedbooleanTrue when the rule’s kill succeeded
rule.onhost.kill_errorstringWhy the kill did not happen: the pid no longer ran the named image, or the OS refused
rule.onhost.kill_disabledbooleanTrue when the rule asked to kill but the group has not enabled kills
auditd.keystringcase-insensitiveTag of the audit rule that produced the record
e.g. xen-persistence
auditd.syscall.namestringcase-insensitiveResolved syscall name for the arch that issued it
e.g. execve
auditd.syscall.numbernumberRaw syscall number (ABI-specific; prefer auditd.syscall.name)
auditd.archstringcase-insensitiveAudit ABI of the calling process
e.g. c000003e
auditd.nametypestringcase-insensitiveHow the path was used: NORMAL, CREATE, DELETE, PARENT
auditd.sessionstringAudit session id; groups everything one login did
auditd.ttystringcase-insensitiveControlling terminal
e.g. pts0
auditd.record_typesstringcase-insensitiveAudit records merged into this event
e.g. SYSCALL,EXECVE,CWD,PATH,PROCTITLE
auditd.record_typestringcase-insensitiveThe audit record this event was built from, when it has no syscall record
e.g. USER_AUTH
auditd.idstringAudit serial number joining related records
auditd.exitnumberSyscall return value; negative is an errno, so a denied open is visible here even when success=yes
e.g. -13
auditd.opstringcase-insensitiveOperation the record names (op=), for records that have no syscall
e.g. PAM:authentication

Case-insensitive fields match regardless of letter case. Groupable fields can be a detection rule's entity, the value alerts are grouped by.

Accepted aliases

Community rules often name fields in their own vocabulary. When an imported Sigma, KQL or EQL rule uses one of these spellings, XenXDR resolves it to the canonical field, so the rule compiles unchanged. Aliases apply to imported rules; stored queries, results and the query bar use the canonical names shown in the fields rail.

FieldAlso accepted
host.namehostname, computername, computer
agent.idagentid
event.modulemodule
event.typeeventtype
event.codeeventid
event.severitylog.level, severity name
user.nameusername, subjectusername, account, detection user, suser, duser, usrName
source.ipsourceip, ipaddress, clientip, SourceIp, IpAddress, src
source.portsourceport, ipport, SourcePort, IpPort, spt, srcPort
destination.ipdestinationip, DestinationIp, dst
destination.portdestinationport, DestinationPort, dpt, dstPort
url.originalurl.full, queryname, dns.question.name, QueryName, request
process.executableprocessname, image, newprocessname, exe, Image, SourceImage, NewProcessName, ProcessName, Process Name, exe, dproc, sproc
process.entity_idprocessguid, ProcessGuid, SourceProcessGUID
process.pidprocessid, ProcessId, NewProcessId
process.parent.entity_idparentprocessguid, ParentProcessGuid, TargetProcessGUID
process.parent.executableparentimage, parentprocessname, process.parent.name, ParentImage, TargetImage, ParentProcessName
process.parent.pidparentprocessid, ParentProcessId
file.hash.sha256hashes, sha256, Hashes, fileHash
process.command_linecommandline
process.parent.command_lineparentcommandline
process.namecomm
process.titleproctitle
process.working_directorycurrentdirectory, cwd
process.integrity_levelintegritylevel
winlog.process.granted_accessgrantedaccess
file.pathtargetfilename, file_path
file.share.namesharename
dll.pathimageloaded
dll.code_signature.signedsigned
registry.pathtargetobject
destination.domaindestinationhostname
network.transportprotocol
dns.answersqueryresults
user.target.nametargetusername, acct, target_user
user.domaintargetdomainname
user.audit.idauid
winlog.logon.typelogontype
winlog.logon.idtargetlogonid
winlog.logon.subject_idsubjectlogonid
winlog.logon.processlogonprocessname
winlog.logon.authentication_packageauthenticationpackagename
winlog.logon.workstationworkstationname
winlog.kerberos.ticket_encryptionticketencryptiontype
winlog.privilegesprivilegelist
winlog.statusstatus
event.outcomesuccess, res
service.nameservicename
service.executableimagepath
winlog.task_nametaskname
powershell.script_block_textscriptblocktext
auditd.keyaudit_key
auditd.syscall.namesyscall_name

Closed vocabularies

Values XenXDR assigns during normalisation. Autocomplete offers them.

event.module — sysmon, defender, security, system, powershell, firewall, scheduled-tasks, application, wmi, rdp, winrm, smb, code-integrity, applocker, bits, winlog, auditd, auth, journald, linux, container, syslog, http, hec, xenxdr, file

event.severity — info, low, medium, high, critical

event.type — process_create, process_exit, process_access, network_connect, dns_query, file_create, registry_set, image_load, create_remote_thread, logon_success, logon_failed, logoff, malware_detected, scriptblock_logged, service_installed, user_created, audit_log_cleared, sensor_state, ipc_connect, network_listen, module_load, module_unload, privilege_change, file_modified, file_delete, file_rename, file_permissions_changed, file_owner_changed, sudo_command, session_start, session_end, audit_config_changed, audit_started, audit_stopped, avc_denied, seccomp_violation, promiscuous_mode, user_deleted, credential_changed, bpf_load, memfd_create, namespace_change, kernel_load, signin, signin_failed, directory_audit