synoti logosynoti logo
Getting Started with rules and filters Standard Event Schema

Standard Event Schema

To help rules operate across various data sources and maintain consistency, the EventProcessor relies on a standardized event schema. Every filter should map extracted data to these standard fields.

Event Structure

The core event object consists of several top-level metadata fields and three main namespaces: log, origin, and target.

Top-Level Metadata

Metadata attributes that characterize the event itself.

FieldDescription
idThe event's unique identifier (UUID).
@timestampThe timestamp indicating when the engine processed the event, expressed in ISO8601 format.
deviceTimeThe timestamp that came from the source device. When it is absent, it falls back to @timestamp.
dataTypeThe log category (for example, syslog, wineventlog, linux, firewall-fortigate-traffic).
dataSourceThe particular source or integration name (for example, o365-tenant-01).
tenantIdUnique identifier of the organization to which the event belongs.
tenantNameName of the tenant in human-readable form.
actionThe action that was carried out (for example, login, file_create, connection).
actionResultThe result of the action (success, failure, denied).
protocolNetwork protocol employed (e.g., tcp, udp, http).
connectionStatusConnection status (e.g., established, closed).
statusCodeNumeric status if applicable (e.g., HTTP 404).
severityImportance level of the event (debug, info, warning, error, critical).
rawThe original, unchanged log message. Read-only.
complianceA mapping of regulatory tags (for example, hipaa, pci, gdpr) to their corresponding values.
errorsA collection of string descriptions covering any problems found during processing.

Namespaces

1. log.* (Custom Data)

The log namespace is a dictionary used to hold any field that does not belong to the standard categories listed below.

  • Usage: log.my_custom_field, log.parsing_status.

2. origin.* and target.* (Sides)

Used to describe the Who and Whom of an event. Both namespaces support an identical set of attributes.

Network Attributes

Column 1Column 2
ipIPv4 or IPv6 address.
hostHostname of the system.
Data 3-1Domain name or FQDN.
portNetwork port (integer).
macMAC address.
urlFull URL if applicable.
cidrNotation for Classless Inter-Domain Routing.
bytesSent / bytesReceivedAmount of data sent.
packagesSent / packagesReceivedCount of network packets.

Fingerprinting & Certificates

FieldDescription
certificateFingerprintSSL/TLS certificate hash.
ja3FingerprintTLS client fingerprint.
jarmFingerprintFingerprint of the active TLS server.
sshBanner / sshFingerprintSSH service identifier.

Identity & Communication

FieldDescription
userAccount identifier or username.
groupSecurity group or role.
email / emailAddressEmail address.
emailSubject / emailBodyEmail content metadata.
emailDisplayName / emailXMailerEmail client metadata.
emailThreadIndexLocation of the email within a conversation thread.
dkim / dkimSignatureEmail authentication information.
jabberId / cookieIdentifiers for Chat or Web sessions.

WHOIS

FieldDescription
whoisRegistrantThe individual or entity that registered the domain.
whoisRegistrarThe company that handles the domain's registration.

Process & File Attributes

FieldDescription
processName of the executable.
processStateCurrent process state.
commandComplete command line executed.
windowsServiceNameLogical service name.
windowsServiceDisplayNameName displayed for the service.
windowsScheduledTaskScheduled task name.
file / filenameBase filename.
pathComplete path leading to the file.
sizeInBytesFile size in bytes.
mimeTypeFile MIME type.

Hashes

FieldDescription
hashCommon hash value, typically SHA256.
md5 / sha1 / sha224 / sha256Particular cryptographic hash values.
sha384 / sha512 / sha512224 / sha512256SHA-2 and variations.
sha3224 / sha3256 / sha3384 / sha3512SHA-3 variants.
authentihash / cdhashCode-signing hashes and operating system-specific hashes.
hex / base64Encoded representations.

System & Infrastructure

FieldDescription
operatingSystemOS name and version.
chromeExtensionBrowser extension ID.
mobileAppIdIdentifier for applications on mobile platforms.
windowsServiceNameThe Windows service's name.
windowsScheduledTaskScheduled task name.

Vulnerabilities & Malware

FieldDescription
cveID from Common Vulnerabilities and Exposures.
cpeCommon Platform Enumeration identifier.
malware / malwareFamilyDetected malware name or family.
malwareTypeMalware category, such as ransomware or trojan.

Resources & Monitoring (Nested under disks)

FieldDescription
connectionsNumber of active connections (uint64).
usedCpuPercentCPU utilization percentage (0-100).
usedMemPercentMemory utilization percentage (0-100).
totalCpuUnitsTotal CPU capacity or units.
totalMemOverall physical memory expressed in bytes.
disksCollection of disk objects (name, totalSpace, usedPercent).

Geolocation (Nested under origin.geolocation.* or target.geolocation.*)

FieldDescription
country / countryCodeThe country’s name and its ISO code.
cityCity name.
latitude / longitudeGeographic coordinates.
asn / asoAutonomous System Number with Organization.
accuracyAccuracy radius for geolocation.

Best Practices for Filtering

  1. Always Map IPs: If your log contains IP addresses, map them to origin.ip and target.ip.

  2. Normalize Actions: Use a consistent set of actions (e.g., login, logout, file_create).

  3. Enrich Early: Apply geolocation and threat intel (feeds) once the core fields have been mapped.

  4. Compliance Mapping: Use the compliance field that labels logs according to regulatory requirements (HIPAA, PCI-DSS, GDPR).

  5. Audit Integrity: The raw field is protected and holds the original log message. Parsing steps cannot remove it, which ensures a verifiable audit trail for every event.