name: siem-host-events
backend: Splunk
description: Host endpoint events including process and file activities.

fields:
  - name: "@timestamp"
    type: date
    description: Event time
    is_key_field: false

  - name: event.dataset
    type: keyword
    description: Dataset type (host)
    is_key_field: false

  - name: event.module
    type: keyword
    description: Module (endpoint)
    is_key_field: false

  - name: event.category
    type: keyword
    description: Event category (process/file)
    is_key_field: true

  - name: event.type
    type: keyword
    description: Event type (process_created/terminated/file_created/deleted/registry_modified)
    is_key_field: true

  - name: event.action
    type: keyword
    description: Event action
    is_key_field: true

  - name: event.outcome
    type: keyword
    description: Event outcome (success/failure)
    is_key_field: false

  - name: host.name
    type: keyword
    description: Host name
    is_key_field: true

  - name: host.id
    type: keyword
    description: Host ID (UUID)
    is_key_field: true

  - name: host.os.name
    type: keyword
    description: OS name (Windows/Linux/macOS)
    is_key_field: false

  - name: host.os.version
    type: keyword
    description: OS version
    is_key_field: false

  - name: host.architecture
    type: keyword
    description: Host architecture (x86_64/arm64)
    is_key_field: false

  - name: user.name
    type: keyword
    description: User name
    is_key_field: true

  - name: user.id
    type: keyword
    description: User ID (SID)
    is_key_field: true

  - name: user.domain
    type: keyword
    description: User domain (CORP/LOCAL/WORKGROUP)
    is_key_field: false

  - name: process.pid
    type: long
    description: Process ID
    is_key_field: true

  - name: process.ppid
    type: long
    description: Parent Process ID
    is_key_field: false

  - name: process.name
    type: keyword
    description: Process name
    is_key_field: true

  - name: process.executable
    type: keyword
    description: Process executable path
    is_key_field: false

  - name: process.command_line
    type: text
    description: Process command line
    is_key_field: false

  - name: process.hash.md5
    type: keyword
    description: Process MD5 hash
    is_key_field: false

  - name: process.hash.sha256
    type: keyword
    description: Process SHA256 hash
    is_key_field: false

  - name: process.parent.name
    type: keyword
    description: Parent process name
    is_key_field: false

  - name: process.parent.pid
    type: long
    description: Parent process ID
    is_key_field: false

  - name: file.name
    type: keyword
    description: File name
    is_key_field: true

  - name: file.path
    type: keyword
    description: File path
    is_key_field: false

  - name: file.size
    type: long
    description: File size in bytes
    is_key_field: false

  - name: file.hash.md5
    type: keyword
    description: File MD5 hash
    is_key_field: false

  - name: file.hash.sha256
    type: keyword
    description: File SHA256 hash
    is_key_field: false

  - name: log.level
    type: keyword
    description: Log level (info/warning/error)
    is_key_field: false

  - name: message
    type: text
    description: Log message
    is_key_field: false
