Scan Event HTTPS Fields

Table of Contents

The following table identifies the Scan Event field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name	Field Type
CreatedBy	created_by	string
CortexDataLakeTenantId	customer_id	string
EnabledRuleCount	enabled_rule_count	int
ErrorCode	error_code.value	string
ErrorMessage	error_message	string
EvalOutcome	eval_outcome.value	string
Labels	labels	string
LogSource	log_source	string
LogSourceGroupID	log_source_group_id	string
DeviceSN	log_source_id	string
DeviceName	log_source_name	string
LogSourceTimeZoneOffset	log_source_tz_offset	int
TimeReceived	log_time	timestamp
LogType	log_type.value	string
ModelAuthor	model_author	string
ModelFormats	model_formats	array
ModelName	model_name	string
ModelURI	model_uri	string
ModelVersion	model_version	string
PlatformType	platform_type	string
RuleFailedCount	rule_failed_count	int
RulePassedCount	rule_passed_count	int
ScanOrigin	scan_origin.value	string
ScanUUID	scan_uuid	string
ScannerVersion	scanner_version	string
SDKVersion	sdk_version	string
SecurityGroupName	security_group_name	string
SecurityGroupUUID	security_group_uuid	string
SourceType	source_type.value	string
SubType	sub_type.value	string
TimeGenerated	time_generated	timestamp
TimeGeneratedHighResolution	time_generated_high_res	timestamp
TimeStarted	time_started	timestamp
TotalFilesScanned	total_files_scanned	int
TotalFilesSkipped	total_files_skipped	int
TSGID	tsg_id	string
VendorName	vendor_name	string
ViolationCount	violation_count	int
Violations	violations	array