Network

Kind

State - something true when Signal read the host

Its time is

connection or listener created

Built-in rules reading it

7

net.protocol

string

The transport: TCP or UDP (ICMP and others where a log records them).

net.local_address

string

This host's address of the connection or listener; 0.0.0.0 or :: is every address the host has.

net.local_port

int

This host's port of the connection or listener.

net.remote_address

string

The other end's address; absent for a listener and a UDP endpoint (the table names no peer).

net.remote_port

int

The other end's port; absent with net.remote_address.

net.remote_scope

string

What kind of address net.remote_address is - or, for a proxy setting, the proxy's address: public (routable on the Internet), private, shared (carrier-grade NAT), loopback, link-local, multicast, or none (no address, or a name).
derived: computed by Signal from the address - no source records it

net.state

string

A TCP endpoint's state as the stack reports it (listening, established, time wait...); for UDP, which has no connections, "bound".

net.direction

string

listening; outbound (this host connected); inbound (the other end connected). For a connection open now, inbound means its local port is one the host listens on - the stack does not record who connected.

process.name

string

Full path of the executable that was launched.

process.pid

int

The new process's own process ID. Always pair with process.start_time when correlating - a bare PID from two different times may not be the same process.

process.user

string

The account (DOMAIN\name) that started the process.

process.user_sid

string

The SID of the account that started the process - what identifies it whatever its name.

file.signer

string

Who signed the entry's program: the name on the signing certificate (Microsoft Windows, Microsoft Corporation, a vendor), from the file's own signature or the Windows catalog that lists it. Empty when unsigned or not checked.
derived: verified by Signal with WinVerifyTrust (embedded signature, else the system catalogs)

file.signature

string

The program's signature: valid, invalid (signed, but the signature or its chain does not verify), unsigned, or not found (no such file). Absent when it could not be checked.
derived: verified by Signal (as file.signer)

file.sha256

string

The SHA-256 of the entry's program (lower-case hex), as found at its path when Signal ran - absent when the file was not found or could not be read.
derived: computed by Signal from the file's content

file.sha1

string

The SHA-1 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

file.md5

string

The MD5 of the same file, computed in the same read as file.sha256 - for matching threat reports and Sysmon, which still name files by it.
derived: computed by Signal from the file's content

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

4

net.protocol

string

The transport: TCP or UDP (ICMP and others where a log records them).

net.local_address

string

This host's address of the connection or listener; 0.0.0.0 or :: is every address the host has.

net.local_port

int

This host's port of the connection or listener.

net.remote_address

string

The other end's address; absent for a listener and a UDP endpoint (the table names no peer).

net.remote_port

int

The other end's port; absent with net.remote_address.

net.remote_scope

string

What kind of address net.remote_address is - or, for a proxy setting, the proxy's address: public (routable on the Internet), private, shared (carrier-grade NAT), loopback, link-local, multicast, or none (no address, or a name).
derived: computed by Signal from the address - no source records it

net.direction

string

listening; outbound (this host connected); inbound (the other end connected). For a connection open now, inbound means its local port is one the host listens on - the stack does not record who connected.

process.name

string

Full path of the executable that was launched.

process.pid

int

The new process's own process ID. Always pair with process.start_time when correlating - a bare PID from two different times may not be the same process.

process.user

string

The account (DOMAIN\name) that started the process.

Kind

Event - something that happened at a time

Its time is

connection logged (firewall log)

Built-in rules reading it

1

net.protocol

string

The transport: TCP or UDP (ICMP and others where a log records them).

net.local_address

string

This host's address of the connection or listener; 0.0.0.0 or :: is every address the host has.

net.local_port

int

This host's port of the connection or listener.

net.remote_address

string

The other end's address; absent for a listener and a UDP endpoint (the table names no peer).

net.remote_port

int

The other end's port; absent with net.remote_address.

net.remote_scope

string

What kind of address net.remote_address is - or, for a proxy setting, the proxy's address: public (routable on the Internet), private, shared (carrier-grade NAT), loopback, link-local, multicast, or none (no address, or a name).
derived: computed by Signal from the address - no source records it

net.direction

string

listening; outbound (this host connected); inbound (the other end connected). For a connection open now, inbound means its local port is one the host listens on - the stack does not record who connected.

process.pid

int

The new process's own process ID. Always pair with process.start_time when correlating - a bare PID from two different times may not be the same process.

Kind

State - something true when Signal read the host

Built-in rules reading it

5

net.setting

string

What kind of setting: hosts entry, hosts file folder, proxy, proxy auto-config, WinHTTP proxy, share.

net.name

string

The name a hosts entry maps, or a share's name; absent for the other settings.

net.value

string

The setting's value as recorded: a hosts entry's address, the hosts file's folder (environment variables unexpanded), a proxy (host:port, or per-protocol list), an auto-configuration script's address, a share's folder.

net.remote_scope

string

What kind of address net.remote_address is - or, for a proxy setting, the proxy's address: public (routable on the Internet), private, shared (carrier-grade NAT), loopback, link-local, multicast, or none (no address, or a name).
derived: computed by Signal from the address - no source records it

net.user

string

The user a proxy setting is set for - the profile folder's name and SID - when it is in that user's registry; absent for the machine's settings.

Kind

State - something true when Signal read the host

Built-in rules reading it

0

net.adapter

string

A network adapter's name as Windows shows it ("Ethernet", "Wi-Fi").

net.adapter_device

string

The adapter's device, as its driver describes it.

net.adapter_kind

string

ethernet, wireless, tunnel, PPP or other - the interface type Windows records (a virtual machine's adapter is often ethernet).

net.adapter_status

string

Whether the adapter is up now, as the stack reports it: up, down, dormant, not present, lower layer down, testing, unknown.

net.addresses

string

The adapter's own addresses with their prefix length (10.0.0.15/24), separated by "; " - as configured now; an address the host held earlier is not listed.

net.gateways

string

The adapter's default gateways, separated by "; ".

net.dns_servers

string

The DNS servers the adapter asks, in order, separated by "; ".

net.dhcp

string

yes when the adapter's IPv4 addresses come from DHCP, no when they are set by hand.

net.dhcp_server

string

The DHCP server that gave the adapter its IPv4 address, when one did.

net.dns_suffix

string

The adapter's DNS suffix (its connection's domain), when it has one.