Detection HTTPS Fields

Table of Contents

The following table identifies the Detection field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name	Field Type
AgentID	agent_id	string
CortexDataLakeTenantId	customer_id	string
DetectionDetails	detection_details	string
DetectionID	detection_id	string
DetectionRiskScore	detection_risk_score	string
DetectorType	detector_type	string
FirstSeenAt	first_seen_at	timestamp
LasSeenAt	last_seen_at	timestamp
LogSource	log_source	string
LogSourceGroupID	log_source_group_id	string
DeviceSN	log_source_id	string
DeviceName	log_source_name	string
LogSourceTimeZoneOffset	log_source_tz_offset	int
TimeReceived	log_time	timestamp
LogType	log_type.value	string
PlatformType	platform_type	string
SaaSAppID	saas_app_id	string
ScanID	scan_id	string
SubType	sub_type.value	string
TimeGenerated	time_generated	timestamp
TimeGeneratedHighResolution	time_generated_high_res	timestamp
TSGID	tsg_id	string
VendorName	vendor_name	string