Scan Event EMAIL Fields

Table of Contents

The following table identifies the Scan Event field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.

EMAIL Name	Query Name
CreatedBy	created_by
CortexDataLakeTenantId	customer_id
EnabledRuleCount	enabled_rule_count
ErrorCode	error_code.value
ErrorMessage	error_message
EvalOutcome	eval_outcome.value
Labels	labels
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
TimeReceived	log_time
LogType	log_type.value
ModelAuthor	model_author
ModelFormats	model_formats
ModelName	model_name
ModelURI	model_uri
ModelVersion	model_version
PlatformType	platform_type
RuleFailedCount	rule_failed_count
RulePassedCount	rule_passed_count
ScanOrigin	scan_origin.value
ScanUUID	scan_uuid
ScannerVersion	scanner_version
SDKVersion	sdk_version
SecurityGroupName	security_group_name
SecurityGroupUUID	security_group_uuid
SourceType	source_type.value
SubType	sub_type.value
TimeGenerated	time_generated
TimeGeneratedHighResolution	time_generated_high_res
TimeStarted	time_started
TotalFilesScanned	total_files_scanned
TotalFilesSkipped	total_files_skipped
TSGID	tsg_id
VendorName	vendor_name
ViolationCount	violation_count
Violations	violations