Returns a pre-defined set of the most relevant XDM schema fields for endpoint investigation:
- _time
- xdm.event.type
- xdm.event.description
- xdm.event.operation
- xdm.event.operation_sub_type
- xdm.source.ipv4
- xdm.source.port
- xdm.source.host.hostname
- xdm.source.host.os
- xdm.source.host.ipv4_addresses
- xdm.source.user.username
- xdm.source.process.name
- xdm.source.process.command_line
- xdm.source.process.executable.signer
- xdm.source.process.executable.md5
- xdm.target.ipv4
- xdm.target.port
- xdm.target.host.hostname
- xdm.target.host.os
- xdm.target.host.ipv4_addresses
- xdm.target.user.username
- xdm.target.process.name
- xdm.target.process.command_line
- xdm.target.file.filename
- xdm.target.domain
- xdm.event.outcome
- xdm.event.outcome_reason
- xdm.observer.product