Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Ingestion API Supported | ✓ Yes |
Source: KQL validation test schema
| Column Name | Type |
|---|---|
| analyzers | dynamic |
| conn_uids | dynamic |
| depth | long |
| duration | real |
| extracted | string |
| extracted_cutoff | bool |
| extracted_size | long |
| filename | string |
| fuid | string |
| id_orig_h | string |
| id_orig_p | int |
| id_resp_h | string |
| id_resp_p | int |
| is_orig | bool |
| local_orig | bool |
| md5 | string |
| mime_type | string |
| missing_bytes | long |
| num | real |
| overflow_bytes | long |
| parent_fuid | string |
| path | string |
| rx_hosts | dynamic |
| seen_bytes | long |
| sha1 | string |
| sha256 | string |
| source | string |
| system_name | string |
| timedout | bool |
| TimeGenerated | datetime |
| total_bytes | long |
| ts | datetime |
| tx_hosts | dynamic |
| Type | string |
| uid | string |
| vlan | real |
| write_ts | datetime |
Official Microsoft Learn documentation for field/column information:
This table is used by the following solutions:
This table is ingested by the following connectors:
| Connector | Selection Criteria |
|---|---|
| Corelight Connector Exporter |
In solution Corelight:
| Hunting Query | Selection Criteria |
|---|---|
| Corelight - Files in logs |
In solution Corelight:
| Workbook | Selection Criteria |
|---|---|
| Corelight | |
| Corelight_Data_Explorer | |
| Corelight_Security_Workflow |
| Parser | Solution | Selection Criteria |
|---|---|---|
| corelight_files | Corelight |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊