fields.common.yml

- key: common
  title: Common
  description: >
    Contains common fields available in all event types.
  fields:

  - name: file
    type: group
    description: File attributes.
    fields:
    - name: setuid
      type: boolean
      example: true
      description: Set if the file has the `setuid` bit set. Omitted otherwise.

    - name: setgid
      type: boolean
      example: true
      description: Set if the file has the `setgid` bit set. Omitted otherwise.

    - name: origin
      type: keyword
      description: >
          An array of strings describing a possible external origin for
          this file. For example, the URL it was downloaded from. Only
          supported in macOS, via the kMDItemWhereFroms attribute.
          Omitted if origin information is not available.
      multi_fields:
      - name: text
        type: text
        description: >
          This is an analyzed field that is useful for full text search
          on the origin data.

    - name: selinux
      type: group
      description: The SELinux identity of the file.
      fields:
      - name: user
        type: keyword
        description: The owner of the object.
      - name: role
        type: keyword
        description: The object's SELinux role.
      - name: domain
        type: keyword
        description: The object's SELinux domain or type.
      - name: level
        type: keyword
        example: s0
        description: The object's SELinux level.

  - name: user
    type: group
    description: User information.
    fields:

    - name: audit
      type: group
      description: Audit user information.
      fields:
      - name: id
        type: keyword
        description: Audit user ID.
      - name: name
        type: keyword
        description: Audit user name.

    - name: filesystem
      type: group
      description: Filesystem user information.
      fields:
      - name: id
        type: keyword
        description: Filesystem user ID.
      - name: name
        type: keyword
        description: Filesystem user name.
      - name: group
        type: group
        description: Filesystem group information.
        fields:
        - name: id
          type: keyword
          description: Filesystem group ID.
        - name: name
          type: keyword
          description: Filesystem group name.

    - name: saved
      type: group
      description: Saved user information.
      fields:
      - name: id
        type: keyword
        description: Saved user ID.
      - name: name
        type: keyword
        description: Saved user name.
      - name: group
        type: group
        description: Saved group information.
        fields:
        - name: id
          type: keyword
          description: Saved group ID.
        - name: name
          type: keyword
          description: Saved group name.