runZero data dictionary
runZero discovers and catalogs the following fields from known protocols and services:
| Protocol | Attribute name | Data type | Single-value |
|---|---|---|---|
| acpp | banner | string | false |
| activemq | activemq.jvm.vendor | string | true |
| activemq | activemq.jvm.version | string | true |
| activemq | activemq.os | string | true |
| activemq | activemq.wireformat.data | string | true |
| activemq | activemq.wireformat.version | string | true |
| adb | adb.access | string | true |
| ads | ads.deviceName | string | true |
| ads | ads.version | string | true |
| airplay | airplay.build | numeric | true |
| airplay | airplay.canRecordScreenStream | boolean | true |
| airplay | airplay.deviceID | string | true |
| airplay | airplay.features | numeric | true |
| airplay | airplay.featuresEx | string | true |
| airplay | airplay.firmwareBuildDate | string | true |
| airplay | airplay.firmwareRevision | numeric | true |
| airplay | airplay.hardwareRevision | numeric | true |
| airplay | airplay.hasUDPMirroringSupport | boolean | true |
| airplay | airplay.initialVolume | numeric | true |
| airplay | airplay.keepAliveLowPower | boolean | true |
| airplay | airplay.keepAliveSendStatsAsBody | boolean | true |
| airplay | airplay.macAddress | string | true |
| airplay | airplay.manufacturer | string | true |
| airplay | airplay.model | string | true |
| airplay | airplay.name | string | true |
| airplay | airplay.osBuildVersion | string | true |
| airplay | airplay.osinfo | string | true |
| airplay | airplay.pi | uuid | true |
| airplay | airplay.pk | string | true |
| airplay | airplay.playbackCapabilities | string | false |
| airplay | airplay.protocolVersion | numeric | true |
| airplay | airplay.ptpinfo | string | true |
| airplay | airplay.receiverHDRCapability | string | true |
| airplay | airplay.screenDemoMode | boolean | true |
| airplay | airplay.sdk | string | true |
| airplay | airplay.senderAddress | string | true |
| airplay | airplay.sourceVersion | numeric | true |
| airplay | airplay.statusFlags | string | true |
| airplay | airplay.supportedFormats | string | true |
| airplay | airplay.volumeControlType | numeric | true |
| airplay | airplay.vv | numeric | true |
| airplay | apache.serverInfo | string | true |
| amqp | amqp.protocolVersion | string | true |
| amqp | amqp.saslRequired | string | true |
| amqp | amqp.tlsRequired | string | true |
| atg | atg.module | string | true |
| atg | atg.software | string | true |
| atg | atg.version | string | true |
| bacnet | bacnet.bbmd | string | false |
| bacnet | bacnet.fdt | string | false |
| bacnet | bacnet.instanceID | numeric | true |
| bacnet | bacnet.pid | numeric | true |
| bacnet | bacnet.vendorID | numeric | true |
| bacnet | bacnet.vendorIDLookup | string | true |
| bedrock | bedrock.contents | string | true |
| bedrock | bedrock.guid | string (hex-encoded) | true |
| bedrock | bedrock.uptime | numeric | true |
| bitdefender-app | bitdefender.deviceID | string | true |
| bitdefender-app | bitdefender.hostname | string | true |
| bitdefender-app | bitdefender.model | string | true |
| bitdefender-app | bitdefender.os | string | true |
| bitdefender-app | bitdefender.type | string | true |
| bjnp | bjnp.ipv4 | string | true |
| bjnp | bjnp.ipv6 | string | true |
| bjnp | bjnp.macAddress | string | true |
| bjnp | bjnp.type | string | true |
| brother-scanner | brother.scanner | string | true |
| cacti | cacti.version | string | true |
| cassandra | cassandra.cluster | string | true |
| cassandra | cassandra.version | string | true |
| chargen | chargen.osGuess | string | true |
| checkmk | banner | string | true |
| checkmk | checkmk.agentOS | string | true |
| checkmk | checkmk.arch | string | true |
| checkmk | checkmk.buildDate | string | true |
| checkmk | checkmk.hostname | string | true |
| checkmk | checkmk.version | string | true |
| cisco-phone | ciscocp.apploadid | string | true |
| cisco-phone | ciscocp.bootloadid | string | true |
| cisco-phone | ciscocp.hostname | string | true |
| cisco-phone | ciscocp.mac | string | true |
| cisco-phone | ciscocp.messagewaiting | string | true |
| cisco-phone | ciscocp.model | string | true |
| cisco-phone | ciscocp.phonedn | string | true |
| cisco-phone | ciscocp.revision | string | true |
| cisco-phone | ciscocp.serial | string | true |
| cisco-phone | ciscocp.series | string | true |
| cisco-phone | ciscocp.udi | string | true |
| cisco-phone | ciscocp.version | string | true |
| ciscosmi | ciscosmi.reply | string (hex-encoded) | true |
| coap | coap.contentUnknown | string | true |
| coap | coap.options | string | true |
| coap | coap.responseCode | string | true |
| coap | coap.type | string | true |
| coap | coap.version | string | true |
| cockpit | cockpit.os | string | true |
| cockpit | host.name | string | false |
| comtrol | dnsServer | string | true |
| comtrol | gateway | string | true |
| comtrol | hostname | string | true |
| comtrol | ipAddress | string | true |
| comtrol | macAddress | string | true |
| comtrol | manufacturer | string | true |
| comtrol | modelName | string | true |
| comtrol | modelNumber | string | true |
| comtrol | netmask | string | true |
| comtrol | osVersion | string | true |
| comtrol | serialNumber | string | true |
| confluence | confluence.baseURL | string | true |
| confluence | confluence.build | string | true |
| confluence | confluence.version | string | true |
| consul | consul.config.version | string | true |
| couchdb | couchdb.version | string | true |
| crestron | crestron.banner | string | true |
| crestron | crestron.buildDate | string | true |
| crestron | crestron.hostname | string | true |
| crestron | crestron.id | string | true |
| crestron | crestron.mac | string | true |
| crestron | crestron.model | string | true |
| crestron | crestron.version | string | true |
| dahua-dhip | dhip.alarmInputChannels | numeric | true |
| dahua-dhip | dhip.alarmOutputChannels | numeric | true |
| dahua-dhip | dhip.deviceClass | string | true |
| dahua-dhip | dhip.deviceType | string | true |
| dahua-dhip | dhip.find | string | true |
| dahua-dhip | dhip.httpPort | numeric | true |
| dahua-dhip | dhip.init | numeric | true |
| dahua-dhip | dhip.ipv4.address | string | true |
| dahua-dhip | dhip.ipv4.dhcp | boolean | true |
| dahua-dhip | dhip.ipv4.gateway | string | true |
| dahua-dhip | dhip.ipv4.netmask | string | true |
| dahua-dhip | dhip.ipv6.address | string | true |
| dahua-dhip | dhip.ipv6.dhcp | boolean | true |
| dahua-dhip | dhip.ipv6.gateway | string | true |
| dahua-dhip | dhip.ipv6.linkLocalAddress | string | true |
| dahua-dhip | dhip.mac | string | true |
| dahua-dhip | dhip.machineName | string | true |
| dahua-dhip | dhip.manufacturer | string | true |
| dahua-dhip | dhip.method | string | true |
| dahua-dhip | dhip.port | numeric | true |
| dahua-dhip | dhip.remoteVideoInputChannels | numeric | true |
| dahua-dhip | dhip.serialNo | string | true |
| dahua-dhip | dhip.vendor | string | true |
| dahua-dhip | dhip.version | string | true |
| dahua-dhip | dhip.videoInputChannels | numeric | true |
| dahua-dhip | dhip.videoOutputChannels | numeric | true |
| daytime | banner | string | true |
| daytime | daytime.osGuess | string | true |
| daytime | daytime.timestamp | string | true |
| dhcp | dhcp.bootFile | string | true |
| dhcp | dhcp.broadcast | boolean | true |
| dhcp | dhcp.class | string | false |
| dhcp | dhcp.clientSystemArchitecture | string | false |
| dhcp | dhcp.clientid.enterprise | string | false |
| dhcp | dhcp.flags | numeric | true |
| dhcp | dhcp.seconds | numeric | true |
| dhcp | dhcp.serverName | string | true |
| dhcp | host.ip | string | false |
| dhcp | host.mac | string | true |
| dhcp | host.name | string | false |
| dns | dns.authors.bind | string | true |
| dns | dns.hostname.bind | string | true |
| dns | dns.id.server | string | true |
| dns | dns.opcode | string | true |
| dns | dns.replies | string | false |
| dns | dns.version.bind | string | true |
| dns | dns.version.server | string | true |
| docker | docker.architecture | string | true |
| docker | docker.dockerRootDir | string | true |
| docker | docker.kernelVersion | string | true |
| docker | docker.memTotal | string | true |
| docker | docker.name | string | true |
| docker | docker.ncpu | string | true |
| docker | docker.operatingSystem | string | true |
| docker | docker.ostype | string | true |
| docker | docker.systemTime | string | true |
| docker | docker.version | string | true |
| dtls | dtls.alert | string (hex-encoded) | true |
| dtls | dtls.encapsulation | string | true |
| dtls | dtls.unknown | string (hex-encoded) | true |
| echo | banner | string | true |
| elasticsearch | elasticsearch.version.number | string | true |
| epm | epm.addrLen | numeric | true |
| epm | epm.address | string | true |
| epm | epm.assocGroup | numeric | true |
| epm | epm.dataRep | string (hex-encoded) | true |
| epm | epm.maxRecvFrag | numeric | true |
| epm | epm.maxSendFrag | numeric | true |
| epm | epm.version | string | true |
| epo | epo.guid | string | true |
| epo | epo.hostname | string | true |
| epo | epo.server | string | true |
| epo | epo.version | string | true |
| epo | mcafeeAgent.hostname | string | true |
| epo | mcafeeAgent.version | string | true |
| etcd2 | etcd2.access | string | true |
| etcd2 | etcd2.keys | string | true |
| fins | fins.model | string | true |
| fins | fins.version | string | true |
| fortigate-to-fortimanager | tls.cipherSuiteNames | string | false |
| fortigate-to-fortimanager | tls.cipherSuites | string | false |
| fortigate-to-fortimanager | tls.extensions | string | false |
| fortigate-to-fortimanager | tls.version | string | true |
| fortigate-to-fortimanager | tls.versionName | string | true |
| ftp | banner | string | true |
| googlewifi | googleWifi.software.version | string | true |
| googlewifi | googleWifi.system.countryCode | string | true |
| googlewifi | googleWifi.system.hardwareID | string | true |
| googlewifi | googleWifi.system.modelID | string | true |
| googlewifi | googleWifi.wan.gateway | string | true |
| googlewifi | googleWifi.wan.localIP | string | true |
| hiddiscoveryd | hiddiscoveryd.address | string | true |
| hiddiscoveryd | hiddiscoveryd.hostname | string | true |
| hiddiscoveryd | hiddiscoveryd.mac | string | true |
| hiddiscoveryd | hiddiscoveryd.model | string | true |
| hiddiscoveryd | hiddiscoveryd.unpatchedVertXploit | string | true |
| hiddiscoveryd | hiddiscoveryd.version | string | true |
| hiddiscoveryd | hiddiscoveryd.versionDate | string | true |
| http | html.copyright | string | true |
| http | html.favicon | string | true |
| http | html.generator | string | true |
| http | html.title | string | true |
| http | http.body | numeric | true |
| http | http.code | numeric | true |
| http | http.head.acceptRanges | string | true |
| http | http.head.contentLength | numeric | true |
| http | http.head.contentType | string | true |
| http | http.head.date | string | true |
| http | http.head.etag | string | true |
| http | http.head.expires | string | true |
| http | http.head.lastModified | string | true |
| http | http.head.location | string | true |
| http | http.head.server | string | true |
| http | http.head.setCookie | string | true |
| http | http.head.vary | string | true |
| http | http.head.xframeoptions | string | true |
| http | http.message | string | true |
| http | http.method | string | true |
| http | http.path | string | true |
| http | http.uri | string | true |
| http | http.url | string | true |
| http | landesk.configPath | string | true |
| http | landesk.providerVersion | string | true |
| http | landesk.serverVersion | string | true |
| ident | ident.error | string | true |
| ident | ident.opSys | string | true |
| ident | ident.osGuess | string | true |
| ident | ident.username | string | true |
| igel-discovery | igel.firmwareVersion | string | true |
| igel-discovery | igel.hostname | string | true |
| igel-discovery | igel.ipAddress | string | true |
| igel-discovery | igel.macAddress | string | true |
| igel-discovery | igel.osType | string | true |
| igel-discovery | igel.productID | string | true |
| igel-discovery | igel.productName | string | true |
| iis | http.owa.version | string | true |
| iis | http.owa.version.full | string | true |
| iis | rdg.authScheme | string | true |
| iis | rdg.transport | string | true |
| ike | ike.exchangeType | string | true |
| ike | ike.flags | string | true |
| ike | ike.initiatorSPI | string (hex-encoded) | true |
| ike | ike.messageID | string | true |
| ike | ike.messageLength | string | true |
| ike | ike.nextPayload | string | true |
| ike | ike.payload | string | true |
| ike | ike.responderSPI | string (hex-encoded) | true |
| ike | ike.sha1 | string (hex-encoded) | true |
| ike | ike.vendorID | string | true |
| ike | ike.version | string | true |
| influxdb | influxdb.build | string | true |
| influxdb | influxdb.databases | string | false |
| influxdb | influxdb.version | string | true |
| ipmi | ipmi.channel | numeric | true |
| ipmi | ipmi.completionCode | numeric | true |
| ipmi | ipmi.connVersions | string | true |
| ipmi | ipmi.connVersionsRaw | string | true |
| ipmi | ipmi.oemData | string | true |
| ipmi | ipmi.oemID | numeric | true |
| ipmi | ipmi.oemName | string | true |
| ipmi | ipmi.passAuth | string | true |
| ipmi | ipmi.passAuthRaw | string | true |
| ipmi | ipmi.srcAddr | numeric | true |
| ipmi | ipmi.srcLun | numeric | true |
| ipmi | ipmi.tgtAddr | numeric | true |
| ipmi | ipmi.tgtLun | numeric | true |
| ipmi | ipmi.userAuth | string | true |
| ipmi | ipmi.userAuthRaw | string | true |
| iscsi | host.ip | string | false |
| iscsi | iscsi.acknowledge | string | true |
| iscsi | iscsi.bidiReadResidualCount | numeric | true |
| iscsi | iscsi.bufferOffset | numeric | true |
| iscsi | iscsi.continue | string | true |
| iscsi | iscsi.currentStage | string | true |
| iscsi | iscsi.dataDigest | string | false |
| iscsi | iscsi.dataSN | numeric | true |
| iscsi | iscsi.expCmdSN | numeric | true |
| iscsi | iscsi.expDataSN | string | true |
| iscsi | iscsi.final | string | true |
| iscsi | iscsi.flags.readResidualOverflow | string | true |
| iscsi | iscsi.flags.readResidualUnderflow | string | true |
| iscsi | iscsi.flags.residualOverflow | string | true |
| iscsi | iscsi.flags.residualUnderflow | string | true |
| iscsi | iscsi.flags.status | string | true |
| iscsi | iscsi.headerDigest | string | true |
| iscsi | iscsi.immediateDelivery | string | true |
| iscsi | iscsi.initiatorTaskTag | string | true |
| iscsi | iscsi.isid | string | false |
| iscsi | iscsi.logout.response | string | true |
| iscsi | iscsi.lun | string | true |
| iscsi | iscsi.lunAddressMode | string | true |
| iscsi | iscsi.maxCmdSN | numeric | true |
| iscsi | iscsi.nextStage | string | true |
| iscsi | iscsi.opcode | string | false |
| iscsi | iscsi.residualCount | numeric | true |
| iscsi | iscsi.response | string | false |
| iscsi | iscsi.statSN | numeric | true |
| iscsi | iscsi.status | string | false |
| iscsi | iscsi.statusClass | string | true |
| iscsi | iscsi.statusDetail | string | true |
| iscsi | iscsi.time2Retain | string | true |
| iscsi | iscsi.time2Wait | string | true |
| iscsi | iscsi.transferTaskTag | string | true |
| iscsi | iscsi.transit | string | true |
| iscsi | iscsi.tsih | string | true |
| iscsi | iscsi.versionMax | string | true |
| iscsi | iscsi.versionMin | string | true |
| jetdirect | pjl.id | string | true |
| jira | jira.baseURL | string | true |
| jira | jira.build | string | true |
| jira | jira.version | string | true |
| jms | banner | string | true |
| jms | jms.services | string | false |
| jms | jms.tcp.ports | string | false |
| jms | jms.version | string | true |
| kasa | kasa.deviceAlias | string | true |
| kasa | kasa.deviceId | string | true |
| kasa | kasa.deviceType | string | true |
| kasa | kasa.hardwareAddress | string | true |
| kasa | kasa.hardwareId | string | true |
| kasa | kasa.hardwareVersion | string | true |
| kasa | kasa.model | string | true |
| kasa | kasa.obdSource | string | true |
| kasa | kasa.oemId | string | true |
| kasa | kasa.softwareVersion | string | true |
| kerberos | kerberos.error | string | true |
| kerberos | kerberos.errorCode | string | true |
| kerberos | kerberos.microseconds | string | true |
| kerberos | kerberos.realm | string | true |
| kerberos | kerberos.serverTS | numeric | true |
| kerberos | kerberos.servicePrincipal | string | true |
| kerberos | kerberos.ticket.realm | string | true |
| kerberos | kerberos.version | string | true |
| knxnet | knxnet.channel | numeric | true |
| knxnet | knxnet.hpaiDataEP | string | true |
| knxnet | knxnet.status | numeric | true |
| knxnet | knxnet.tunnelData | string (hex-encoded) | true |
| knxnet | knxnet.tunnelEP | string | true |
| knxnet | knxnet.type | string | true |
| l2t | l2t.attrCount | numeric | true |
| l2t | l2t.type | numeric | true |
| l2t | l2t.version | numeric | true |
| l2tp | l2tp.assignedTunnelID | numeric | true |
| l2tp | l2tp.bearerCaps | numeric | true |
| l2tp | l2tp.controlCode | numeric | true |
| l2tp | l2tp.errorCode | numeric | true |
| l2tp | l2tp.errorMsg | string | true |
| l2tp | l2tp.firmwareRevision | numeric | true |
| l2tp | l2tp.framingCaps | numeric | true |
| l2tp | l2tp.hostName | string | true |
| l2tp | l2tp.nr | numeric | true |
| l2tp | l2tp.ns | numeric | true |
| l2tp | l2tp.protoVersion | string | true |
| l2tp | l2tp.recvWindowSize | numeric | true |
| l2tp | l2tp.resultCode | numeric | true |
| l2tp | l2tp.sessionID | numeric | true |
| l2tp | l2tp.tunnelID | numeric | true |
| l2tp | l2tp.vendorName | string | true |
| lantronix | lantronix.fwinfo | string (hex-encoded) | true |
| lantronix | lantronix.mac | string | true |
| lantronix | lantronix.macVendor | string | true |
| lantronix | lantronix.serial | string | true |
| lantronix | lantronix.type | string | true |
| lantronix | lantronix.version | string | true |
| ldap | ldap.notes | string | false |
| ldap | ldap.searchresult | string | true |
| lexmark | banner | string | true |
| lockdownd | lockdownd.cpuArchitecture | string | true |
| lockdownd | lockdownd.deviceName | string | true |
| lockdownd | lockdownd.hardwareModel | string | true |
| lockdownd | lockdownd.productName | string | true |
| lockdownd | lockdownd.productType | string | true |
| lockdownd | lockdownd.productVersion | string | true |
| lockdownd | lockdownd.supportedDeviceFamilies | string | true |
| lpd | lpd.banner | string | true |
| mdns | mdns.addrs | string | false |
| mdns | mdns.authors.bind | string | true |
| mdns | mdns.hostname.bind | string | true |
| mdns | mdns.id.server | string | true |
| mdns | mdns.replies | string | false |
| mdns | mdns.version.bind | string | true |
| mdns | mdns.version.server | string | true |
| mikrotik-bandwidth | banner | string | true |
| minecraft | minecraft.currentplayers | string | true |
| minecraft | minecraft.maxplayers | string | true |
| minecraft | minecraft.motd | string | true |
| minecraft | minecraft.version | string | true |
| modbus | modbus.applicationName | string | true |
| modbus | modbus.exception | string | true |
| modbus | modbus.function | string | true |
| modbus | modbus.identifier | string | true |
| modbus | modbus.modelName | string | true |
| modbus | modbus.productCode | string | true |
| modbus | modbus.productName | string | true |
| modbus | modbus.revision | string | true |
| modbus | modbus.unitID | numeric | true |
| modbus | modbus.vendor | string | true |
| modbus | modbus.vendorURL | string | true |
| mqtt | mqtt.broker.authRequired | string | false |
| mqtt | mqtt.broker.supportedProtocols | string | false |
| mssql_browser | mssql.browser.response | string | false |
| mssql_browser | mssql.tcp.ports | string | false |
| munin | munin.capabilities | string | false |
| munin | munin.metrics | string | false |
| munin | munin.nodes | string | false |
| munin | munin.tlsRequired | string | true |
| munin | munin.version | string | true |
| mysql | mysql.error | string | true |
| mysql | mysql.version | string | true |
| mysqlx | mysqlx.error | string | true |
| mysqlx | mysqlx.errorCode | string | true |
| mysqlx | mysqlx.errorSeverity | string | true |
| natpmp | natpmp.externalIP | string | true |
| natpmp | natpmp.lastChange | string | true |
| natpmp | natpmp.responseCode | numeric | true |
| ndmp | ndmp.reason | string | true |
| ndmp | ndmp.status | string | true |
| ndmp | ndmp.timestampTS | numeric | true |
| ndmp | ndmp.version | string | true |
| neo4j | neo4j.neo4jVersion | string | true |
| netbios-dgm | cifs.comment | string | true |
| netbios-dgm | cifs.os.version | string | true |
| netbios-dgm | cifs.serverType | string | true |
| netbios-dgm | host.name | string | true |
| netbios-dgm | netbios.nodeType | string | true |
| netbios-ns | netbios.addrs | string | false |
| netbios-ns | netbios.domain | string | true |
| netbios-ns | netbios.domainController | string | true |
| netbios-ns | netbios.mac | string | true |
| netbios-ns | netbios.macDateAdded | string | true |
| netbios-ns | netbios.macVendor | string | true |
| netbios-ns | netbios.name | string | true |
| netbios-ns | netbios.primarydomainController | string | true |
| netbios-ns | netbios.username | string | true |
| nfs | nfs.maxVersion | numeric | true |
| nfs | nfs.minVersion | numeric | true |
| nfs | nfs.unknownReply | string (hex-encoded) | true |
| ntp | ntp.interval | numeric | true |
| ntp | ntp.readVar | string | true |
| ntp | ntp.referenceID | string | true |
| ntp | ntp.skew | string | true |
| ntp | ntp.skewMS | numeric | true |
| ntp | ntp.stratum | numeric | true |
| ntp | ntp.swVersion | string | true |
| ntp | ntp.timestamp | numeric | true |
| ntp | ntp.version | numeric | true |
| opcua | opcua.applications | string | false |
| opcua | opcua.clientThumbprint | string | true |
| opcua | opcua.endpoints | string | false |
| opcua | opcua.error | string | true |
| opcua | opcua.errorReason | string | true |
| opcua | opcua.errorText | string | true |
| opcua | opcua.messageType | string | true |
| opcua | opcua.protocol | numeric | true |
| opcua | opcua.securityPolicy | string | true |
| opcua | opcua.supportedMessageSecurityModes | string | false |
| opcua | opcua.supportedSecurityPolicies | string | false |
| opcua | opcua.supportedUserTokenTypes | string | false |
| opcua | opcua.unknownNodeId | string | false |
| openvpn | openvpn.reply | string (hex-encoded) | true |
| oracledb | oracledb.tns.error | string | true |
| oracledb | oracledb.tns.version | string | true |
| oracledb | oracledb.tns.vsn | string | true |
| orion | orion.components | string | true |
| orion | orion.version | string | true |
| pca | command | string | true |
| pca | pca.caps | string | true |
| pca | pca.name | string | true |
| pca | pca.status | string (hex-encoded) | true |
| pcworx | pcworx.firmwareDate | string | true |
| pcworx | pcworx.firmwareTime | string | true |
| pcworx | pcworx.firmwareVersion | string | true |
| pcworx | pcworx.modelNumber | string | true |
| pcworx | pcworx.plcType | string | true |
| pega | pega.version | string | true |
| postgresql | postgresql.auth.details | string | true |
| postgresql | postgresql.auth.method | string | true |
| postgresql | postgresql.error.code | string | true |
| postgresql | postgresql.error.file | string | true |
| postgresql | postgresql.error.line | string | true |
| postgresql | postgresql.error.message | string | true |
| postgresql | postgresql.error.routine | string | true |
| postgresql | postgresql.error.severity | string | true |
| postgresql | postgresql.error.text | string | true |
| pptp | pptp.bearerCapabilities | string | true |
| pptp | pptp.errorCode | numeric | true |
| pptp | pptp.framingCapabilities | string | true |
| pptp | pptp.fwRevision | numeric | true |
| pptp | pptp.hostname | string | true |
| pptp | pptp.maxChannels | numeric | true |
| pptp | pptp.resultCode | numeric | true |
| pptp | pptp.vendor | string | true |
| prosoft | firmwareDate | string | true |
| prosoft | moduleName | string | true |
| prosoft | moduleRevision | string | true |
| prosoft | moduleSerial | string | true |
| prosoft | moduleStatus | string | true |
| psdisco | psdisco.appName | string | true |
| psdisco | psdisco.appTitleID | string | true |
| psdisco | psdisco.code | string | true |
| psdisco | psdisco.id | string | true |
| psdisco | psdisco.name | string | true |
| psdisco | psdisco.protoVersion | string | true |
| psdisco | psdisco.requestPort | numeric | true |
| psdisco | psdisco.status | string | true |
| psdisco | psdisco.sysVersion | string | true |
| psdisco | psdisco.type | string | true |
| pwa_manifest | pwaManifest.id | string | true |
| pwa_manifest | pwaManifest.name | string | true |
| pwa_manifest | pwaManifest.shortName | string | true |
| pwa_manifest | pwaManifest.startUrl | string | true |
| qotd | banner | string | true |
| qualys | qualys.correlationID | string | true |
| radius | radius.replyMessages | string | true |
| rdp | rdp.auth.nla | string | true |
| rdp | rdp.auth.rdp | string | true |
| rdp | rdp.auth.ssl | string | true |
| rdp | rdp.auth.sspeua | string | true |
| rdp | rdp.auth.tls | string | true |
| redis | redis.protectedMode | string | true |
| rexec | banner | string | true |
| riak | riak.nodename | string | true |
| riak | riak.version | string | true |
| riak-http | riak-http.version | string | true |
| roomalert | roomalert.ipAddress | string | false |
| roomalert | roomalert.macAddress | string | false |
| roomalert | roomalert.model | string | false |
| roomalert | roomalert.osVersion | string | false |
| rtsp | rtsp.head.* | string | true |
| sadp | sadp.activated | string | true |
| sadp | sadp.analogChannelNum | string | true |
| sadp | sadp.bootTime | string | true |
| sadp | sadp.cmdPort | string | true |
| sadp | sadp.deviceDesc | string | true |
| sadp | sadp.deviceSerial | string | true |
| sadp | sadp.deviceType | string | true |
| sadp | sadp.dhcp | string | true |
| sadp | sadp.digitalChannelNum | string | true |
| sadp | sadp.dspVersion | string | true |
| sadp | sadp.httpPort | string | true |
| sadp | sadp.ipv4.address | string | true |
| sadp | sadp.ipv4.gateway | string | true |
| sadp | sadp.ipv4.subnet | string | true |
| sadp | sadp.ipv6.address | string | true |
| sadp | sadp.ipv6.gateway | string | true |
| sadp | sadp.ipv6.maskLen | string | true |
| sadp | sadp.mac | string | true |
| sadp | sadp.oemInfo | string | true |
| sadp | sadp.passwordResetAbility | string | true |
| sadp | sadp.softwareVersion | string | true |
| sadp | sadp.uuid | string | true |
| securemote | securemote.hostname | string | true |
| securemote | securemote.server | string | true |
| servicetag | serviceTag.agentURN | string | true |
| servicetag | serviceTag.agentVersion | string | true |
| servicetag | serviceTag.registryVersion | string | true |
| servicetag | serviceTag.sysinfo.cpuInfo.name | string | true |
| servicetag | serviceTag.sysinfo.cpuMfg | string | true |
| servicetag | serviceTag.sysinfo.hostID | string | true |
| servicetag | serviceTag.sysinfo.hostname | string | true |
| servicetag | serviceTag.sysinfo.mfg | string | true |
| servicetag | serviceTag.sysinfo.platform | string | true |
| servicetag | serviceTag.sysinfo.release | string | true |
| servicetag | serviceTag.sysinfo.serialNumber | string | true |
| servicetag | serviceTag.sysinfo.system | string | true |
| sip | sip.head.* | string | true |
| slp | slp.version | numeric | true |
| smb3 | ntlmssp.dnsComputer | string | true |
| smb3 | ntlmssp.dnsDomain | string | true |
| smb3 | ntlmssp.negFlags | string | true |
| smb3 | ntlmssp.netbiosComputer | string | true |
| smb3 | ntlmssp.netbiosDomain | string | true |
| smb3 | ntlmssp.ntlmRevision | numeric | true |
| smb3 | ntlmssp.targetName | string | true |
| smb3 | ntlmssp.version | string | true |
| smb3 | ntlmssp.versionInvalid | string | true |
| smb3 | smb.accessControl | string | true |
| smb3 | smb.capabilities | string | true |
| smb3 | smb.cipherAlg | string | false |
| smb3 | smb.cipherAlgCnt | string | true |
| smb3 | smb.compAlg | string | false |
| smb3 | smb.compAlgCnt | string | true |
| smb3 | smb.compFlags | numeric | true |
| smb3 | smb.dialect | string | true |
| smb3 | smb.guid | string | true |
| smb3 | smb.hashAlg | string | false |
| smb3 | smb.hashAlgCnt | string | true |
| smb3 | smb.hashSaltLen | string | true |
| smb3 | smb.nativeLM | string | true |
| smb3 | smb.nativeOS | string | true |
| smb3 | smb.netName | string | true |
| smb3 | smb.netbiosComputer | string | true |
| smb3 | smb.netbiosDomain | string | true |
| smb3 | smb.posixExtensions | string | true |
| smb3 | smb.rdmaTransformCnt | string | true |
| smb3 | smb.rdmaTransforms | string | false |
| smb3 | smb.sessionID | string | true |
| smb3 | smb.signing | string | true |
| smb3 | smb.signingAlg | string | false |
| smb3 | smb.signingAlgCnt | string | true |
| smb3 | smb.supportsEncryptedPasswords | string | true |
| smb3 | smb.transportSecurity | string | true |
| smtp | banner | string | true |
| snmp | snmp.defaultCommunities | string | true |
| snmp | snmp.interfaceAddrs | string | false |
| snmp | snmp.interfaceMacs | string | false |
| snmp | snmp.interfaces | string | false |
| snmp | snmp.secretCommunities | string | true |
| snmp | snmp.version | string | true |
| socks | banner | string | true |
| splunk | splunk.build | string | true |
| splunk | splunk.version | string | true |
| spotify-connect | brandDisplayName | string | true |
| spotify-connect | clientID | string | true |
| spotify-connect | deviceID | string | true |
| spotify-connect | deviceType | string | true |
| spotify-connect | modelDisplayName | string | true |
| spotify-connect | remoteName | string | true |
| spotify-connect | scope | string | true |
| spotify-connect | status | string | true |
| spotify-connect | statusString | string | true |
| ssdp | ssdp.head.* | string | false |
| ssh | banner | string | true |
| steam | steam.authKeyIDs | string | true |
| steam | steam.broadcastingActive | boolean | true |
| steam | steam.clientID | numeric | true |
| steam | steam.connectPort | numeric | true |
| steam | steam.contentCachePort | numeric | true |
| steam | steam.deviceID | numeric | true |
| steam | steam.downloadLANPeerGroup | numeric | true |
| steam | steam.eUniverse | numeric | true |
| steam | steam.enabledServices | numeric | true |
| steam | steam.gamesRunning | boolean | true |
| steam | steam.hostname | string | true |
| steam | steam.instanceID | numeric | true |
| steam | steam.ipAddresses | string | true |
| steam | steam.is64Bit | boolean | true |
| steam | steam.isSteamDeck | boolean | true |
| steam | steam.macAddresses | string | true |
| steam | steam.minVersion | numeric | true |
| steam | steam.osType | numeric | true |
| steam | steam.publicIPAddress | string | true |
| steam | steam.remotePlayActive | boolean | true |
| steam | steam.screenLocked | boolean | true |
| steam | steam.steamIDs | string | true |
| steam | steam.steamVersion | numeric | true |
| steam | steam.supportedServices | numeric | true |
| steam | steam.timestamp | numeric | true |
| steam | steam.version | numeric | true |
| steam | steam.vrActive | boolean | true |
| sunrpc | rpcbind.acceptState | string | true |
| sunrpc | rpcbind.error | string | true |
| sunrpc | rpcbind.programs | string | true |
| sunrpc | rpcbind.versionRange | string | true |
| syslog | host.name | string | true |
| tcp | banner | string | true |
| tcp | data | string (hex-encoded) | true |
| tcp | tcp.flags | string | false |
| tcp | tcp.options | numeric | true |
| tcp | tcp.ts | numeric | true |
| tcp | tcp.urg | numeric | true |
| tcp | tcp.win | numeric | true |
| tcpmux | banner | string | true |
| teamviewer | teamviewer.response | string (hex-encoded) | true |
| telnet | banner | string | true |
| tftp | tftp.error | numeric | true |
| tftp | tftp.message | string | true |
| tftp | tftp.mode | string | true |
| tftp | tftp.opcode | string | true |
| time | time.skew | string | true |
| time | time.skewMS | numeric | true |
| time | time.timestamp | string | true |
| time | time.value | numeric | true |
| tls | tls.authorityKeyID | string (hex-encoded) | true |
| tls | tls.caUnknown | string | true |
| tls | tls.certificate | string | true |
| tls | tls.certificates | string | true |
| tls | tls.cipher | string | true |
| tls | tls.cipherName | string | true |
| tls | tls.cn | string | true |
| tls | tls.crl | string | false |
| tls | tls.emails | string | false |
| tls | tls.expired | string | true |
| tls | tls.fp.bkhash | string | true |
| tls | tls.fp.caSha1 | string | false |
| tls | tls.fp.sha1 | string | true |
| tls | tls.fp.sha256 | string | true |
| tls | tls.issuer | string | true |
| tls | tls.issuingURL | string | false |
| tls | tls.names | string | false |
| tls | tls.notAfter | string | true |
| tls | tls.notAfterTS | numeric | true |
| tls | tls.notBefore | string | true |
| tls | tls.notBeforeTS | numeric | true |
| tls | tls.ocsp | string | false |
| tls | tls.requiresClientCertificate | string | true |
| tls | tls.selfSigned | string | true |
| tls | tls.serial | string | true |
| tls | tls.signatureAlgorithm | string | true |
| tls | tls.subject | string | true |
| tls | tls.subjectKeyID | string (hex-encoded) | true |
| tls | tls.uri | string | false |
| tls | tls.version | string | true |
| tls | tls.versionName | string | true |
| ubnt | ubnt.addrs | string | false |
| ubnt | ubnt.configStatus | string | true |
| ubnt | ubnt.directConnectDomain | string | true |
| ubnt | ubnt.essid | string | true |
| ubnt | ubnt.firmware | string | true |
| ubnt | ubnt.hostName | string | true |
| ubnt | ubnt.interfaceMap | string | false |
| ubnt | ubnt.macs | string | false |
| ubnt | ubnt.modelFull | string | true |
| ubnt | ubnt.modelShort | string | true |
| ubnt | ubnt.protoVersion | string | true |
| ubnt | ubnt.sourceMAC | string | false |
| ubnt | ubnt.unifiVersion | string | true |
| ubnt | ubnt.uptime | string | true |
| ubnt | ubnt.webMgmtPort | numeric | true |
| ubnt | ubnt.webMgmtTLS | string | true |
| ubnt | ubnt.wmode | string | false |
| upnp | upnp.controlURL | string | true |
| upnp | upnp.deviceType | string | true |
| upnp | upnp.eventSubURL | string | true |
| upnp | upnp.friendlyName | string | true |
| upnp | upnp.manufacturer | string | true |
| upnp | upnp.manufacturerURL | string | true |
| upnp | upnp.modelDescription | string | true |
| upnp | upnp.modelName | string | true |
| upnp | upnp.modelNumber | string | true |
| upnp | upnp.modelURL | string | true |
| upnp | upnp.presentationURL | string | true |
| upnp | upnp.scpdURL | string | true |
| upnp | upnp.serialNumber | string | true |
| upnp | upnp.udn | string | true |
| upnp | upnp.upc | string | true |
| upnp | upnp.url | string | true |
| upnp | upnp.urlBase | string | true |
| upnp | upnp.wifiMac | string | true |
| upnp | upnp.wiredMac | string | true |
| uscan | uscan.makeAndModel | string | true |
| uscan | uscan.manufacturer | string | true |
| uscan | uscan.serialNumber | string | true |
| uscan | uscan.version | string | true |
| vault | vault.version | string | true |
| vnc | vnc.version | string | true |
| wbsm | wbsm.active | string | false |
| webmin | webmin.port | numeric | true |
| webmin | webmin.scheme | string | true |
| webmin | webmin.server | string | true |
| wsd | wsd.addrs | string | false |
| wsd | wsd.types | string | true |
| wsman | wsman.body | string | true |
| xdmcp | xdmcp.address | string | true |
| xdmcp | xdmcp.hostname | string | true |
| xdmcp | xdmcp.manufacturer | string | true |
| xdmcp | xdmcp.port | string | true |
| xdmcp | xdmcp.status | string | true |
| zabbix-agent | zabbix.agentVersion | string | true |
| zookeeper | zk.access | string | true |
| zyxel | zyxel.builddate | string | true |
| zyxel | zyxel.dhcpstate | string | true |
| zyxel | zyxel.firmware | string | true |
| zyxel | zyxel.firstlogin | string | true |
| zyxel | zyxel.gateway | string | true |
| zyxel | zyxel.hostname | string | true |
| zyxel | zyxel.ip | string | true |
| zyxel | zyxel.mac | string | true |
| zyxel | zyxel.maxport | string | true |
| zyxel | zyxel.model | string | true |
| zyxel | zyxel.subnetmask | string | true |
| zyxel | zyxel.uptime | string | true |
Updated