# AgentX Linux field mappings

### **Unix Sysmon**

**Event ID: 1**

| **Unix Field**            | **Logpoint Field** |
| ------------------------- | ------------------ |
| EventData\_Domain         | caller\_domain     |
| EventData\_IntegrityLevel | integrity\_level   |
| EventData\_ParentUser     | parent\_user       |

**Event ID: 3**

| **Unix Field**       | **Logpoint Field** |
| -------------------- | ------------------ |
| EventData\_Initiated | is\_initiated      |

**Event ID: 4**

| **Unix Field**           | **Logpoint Field** |
| ------------------------ | ------------------ |
| EventData\_SchemaVersion | schema\_version    |
| EventData\_State         | status             |
| EventData\_Version       | version            |

**Event ID: 16**

| **Unix Field**           | **LogPoint Field** |
| ------------------------ | ------------------ |
| EventData\_Configuration | file               |

**Event ID: 23**

| **Unix Field**          | **Logpoint Field** |
| ----------------------- | ------------------ |
| EventData\_IsExecutable | is\_executable     |
| EventData\_Archived     | is\_archived       |

#### **Unix Sysmon Generic Taxonomy**

| **Unix Field**                  | **Logpoint Field**                        |
| ------------------------------- | ----------------------------------------- |
| agent\_name                     | agentx\_agent                             |
| agent\_ip                       | agentx\_agent\_address                    |
| decoder\_name                   | agentx\_decoder                           |
| EventData\_AccountName          | user                                      |
| EventData\_CommandLine          | command                                   |
| EventData\_Company              | vendor                                    |
| EventData\_CreationUtcTime      | creation\_ts                              |
| EventData\_CurrentDirectory     | path                                      |
| EventData\_Description          | description                               |
| EventData\_DestinationHostname  | destination\_host                         |
| EventData\_DestinationIp        | destination\_address                      |
| EventData\_DestinationIsIpv6    | is\_destination\_ipv6                     |
| EventData\_DestinationPort      | destination\_port                         |
| EventData\_DestinationPortName  | service                                   |
| EventData\_EventType            | event\_type                               |
| EventData\_FileVersion          | file\_version                             |
| EventData\_Image                | image                                     |
| EventData\_LogonGuid            | logon\_guid                               |
| EventData\_LogonId              | logon\_id                                 |
| EventData\_OriginalFileName     | file                                      |
| EventData\_ParentCommandLine    | parent\_command                           |
| EventData\_ParentImage          | parent\_image                             |
| EventData\_ParentProcessGuid    | parent\_process\_guid                     |
| EventData\_ParentProcessId      | parent\_process\_id                       |
| EventData\_ProcessGuid          | process\_guid                             |
| EventData\_ProcessId            | process\_id                               |
| EventData\_Product              | application                               |
| EventData\_Protocol             | protocol                                  |
| EventData\_QueryName            | query                                     |
| EventData\_QueryStatus          | status                                    |
| EventData\_RuleName             | rule                                      |
| EventData\_SourceHostname       | source\_host                              |
| EventData\_SourceIp             | source\_address                           |
| EventData\_SourceIsIpv6         | is\_source\_ipv6                          |
| EventData\_SourcePort           | source\_port                              |
| EventData\_TargetFilename       | target\_file                              |
| EventData\_TerminalSessionId    | session\_id                               |
| EventData\_User                 | user                                      |
| EventData\_UtcTime              | utc\_ts                                   |
| id                              | id                                        |
| location                        | location                                  |
| manager\_name                   | agentx\_manager                           |
| System\_Channel                 | channel                                   |
| System\_Computer                | host                                      |
| System\_EventID                 | event\_id                                 |
| System\_EventRecordID           | record\_id                                |
| System\_Keywords                | keyword                                   |
| System\_Level                   | severity                                  |
| System\_Opcode                  | opcode\_value                             |
| System\_Execution\_ProcessID    | execution\_process\_id                    |
| System\_Security\_UserId        | user\_id                                  |
| System\_Provider\_Guid          | guid                                      |
| System\_Provider\_Name          | event\_source                             |
| System\_SeverityValue           | log\_level                                |
| System\_TimeCreated\_SystemTime | log\_ts                                   |
| System\_Task                    | task\_value                               |
| System\_Execution\_ThreadID     | execution\_thread\_id                     |
| System\_Version                 | version                                   |
| timestamp                       | event\_received\_ts                       |
| AllowHardTerminate              | allow\_hard\_terminate                    |
| AllowStartOnDemand              | allow\_start\_on\_demand                  |
| Arguments                       | argument                                  |
| Author                          | author                                    |
| ClassId                         | class\_id                                 |
| Command                         | command                                   |
| Count                           | restart\_failure\_count                   |
| Data                            | data                                      |
| DataOffset                      | data\_offset                              |
| Date                            | date                                      |
| DaysInterval                    | days\_interval                            |
| Deadline                        | deadline                                  |
| Delay                           | delay                                     |
| Description                     | description                               |
| DisallowStartIfOnBatteries      | disallow\_start\_if\_on\_batteries        |
| DisallowStartOnRemoteAppSession | disallow\_start\_on\_remote\_app\_session |
| Duration                        | duration                                  |
| Enabled                         | enabled                                   |
| Exclusive                       | exclusive                                 |
| ExecutionTimeLimit              | execution\_time\_limit                    |
| GroupId                         | group\_id                                 |
| Hidden                          | hidden                                    |
| Interval                        | restart\_failure\_interval                |
| LogonType                       | logon\_type                               |
| MultipleInstancesPolicy         | multiple\_instance\_policy                |
| Period                          | period                                    |
| Priority                        | priority                                  |
| RandomDelay                     | random\_delay                             |
| RestartOnIdle                   | restart\_on\_idle                         |
| RunLevel                        | run\_level                                |
| RunOnlyIfIdle                   | run\_only\_if\_idle                       |
| RunOnlyIfNetworkAvailable       | run\_only\_if\_network\_available         |
| SecurityDescriptor              | sd                                        |
| Source                          | source                                    |
| StartBoundary                   | start\_ts                                 |
| StartWhenAvailable              | start\_when\_available                    |
| StateChange                     | state\_change                             |
| StateName                       | state\_name                               |
| StopAtDurationEnd               | stop\_at\_duration\_end                   |
| StopIfGoingOnBatteries          | stop\_if\_going\_on\_batteries            |
| StopOnIdleEnd                   | stop\_on\_idle\_end                       |
| URI                             | url                                       |
| UseUnifiedSchedulingEngine      | use\_unified\_scheduling\_engine          |
| UserId                          | user\_id                                  |
| Version                         | version                                   |
| WaitTimeout                     | wait\_timeout                             |
| WakeToRun                       | wake\_to\_run                             |
| access\_list                    | access\_list                              |
| action                          | action                                    |
| description                     | description                               |
| integrity\_label                | integrity\_label                          |
| logon\_category                 | logon\_category                           |
| message                         | message                                   |
| object                          | object                                    |
| right                           | right                                     |
| rule\_description               | rule\_description                         |
| rule\_firedtimes                | rule\_trigger\_count                      |
| rule\_frequency                 | rule\_frequency                           |
| rule\_gdpr                      | gdpr                                      |
| rule\_gpg13                     | gpg13                                     |
| rule\_groups                    | rule\_group                               |
| rule\_hipaa                     | hipaa                                     |
| rule\_id                        | rule\_trigger\_id                         |
| rule\_level                     | rule\_level                               |
| rule\_mail                      | rule\_mail                                |
| rule\_mitre\_id                 | attack\_id                                |
| rule\_mitre\_tactic             | attack\_category                          |
| rule\_mitre\_technique          | attack\_tag                               |
| rule\_nist\_800\_53             | nist\_800\_53                             |
| rule\_pci\_dss                  | pci\_dss                                  |
| rule\_tsc                       | tsc                                       |

### **Unix Audit Log Taxonomy**

| **Unix Field**         | **Logpoint Field**                 |
| ---------------------- | ---------------------------------- |
| ARCH                   | processor\_architecture            |
| AUID                   | audit\_user                        |
| EGID                   | effective\_group                   |
| EUID                   | effective\_user                    |
| FSGID                  | file\_system\_group                |
| FSUID                  | file\_system\_user                 |
| GID                    | group                              |
| OGID                   | owner\_group                       |
| PPID                   | parent\_process                    |
| SAUID                  | sender\_audit\_user                |
| SGID                   | set\_group                         |
| SPID                   | sent\_process                      |
| SUID                   | set\_user                          |
| SYSCALL                | system\_call                       |
| UID                    | user                               |
| a0                     | argument0                          |
| a1                     | argument1                          |
| a10                    | argument10                         |
| a11                    | argument11                         |
| a12                    | argument12                         |
| a13                    | argument13                         |
| a14                    | argument14                         |
| a15                    | argument15                         |
| a16                    | argument16                         |
| a17                    | argument17                         |
| a18                    | argument18                         |
| a19                    | argument19                         |
| a2                     | argument2                          |
| a20                    | argument20                         |
| a3                     | argument3                          |
| a4                     | argument4                          |
| a5                     | argument5                          |
| a6                     | argument6                          |
| a7                     | argument7                          |
| a8                     | argument8                          |
| a9                     | argument9                          |
| acct                   | user                               |
| addr                   | source\_address                    |
| agent\_id              | agentx\_agent\_id                  |
| agent\_ip              | agentx\_agent\_address             |
| agent\_name            | agentx\_agent                      |
| algo                   | algorithm                          |
| arch                   | processor\_architecture            |
| argc                   | argument\_count                    |
| auid                   | audit\_user\_id                    |
| cap\_fi                | inherited\_file\_system\_privilege |
| cap\_fp                | permitted\_file\_system\_privilege |
| cap\_pe                | effective\_process\_privilege      |
| cap\_pi                | inherited\_process\_privilege      |
| cap\_pp                | permitted\_process\_privilege      |
| capability             | privilege                          |
| cgroup                 | path                               |
| cmd                    | command                            |
| comm                   | command                            |
| cwd                    | path                               |
| decoder\_name          | agentx\_decoder                    |
| dev                    | device\_id                         |
| devmajor               | major\_device\_id                  |
| devminor               | minor\_device\_id                  |
| egid                   | effective\_group\_id               |
| euid                   | effective\_user\_id                |
| exe                    | path                               |
| exit                   | status\_code                       |
| family                 | address\_type                      |
| fd                     | file\_descriptor                   |
| filetype               | file\_type                         |
| flags                  | flag                               |
| fsgid                  | file\_system\_group\_id            |
| fsuid                  | file\_system\_user\_id             |
| fver                   | version                            |
| gid                    | group\_id                          |
| hostname               | hostname                           |
| icmptype               | icmp\_type                         |
| ino                    | inode                              |
| inode                  | inode                              |
| inode\_gid             | inode\_group\_id                   |
| inode\_uid             | inode\_user\_id                    |
| items                  | item\_count                        |
| key                    | key                                |
| ksize                  | key\_size                          |
| laddr                  | destination\_address               |
| list                   | list\_id                           |
| log\_type              | log\_level                         |
| lport                  | destination\_port                  |
| manager\_name          | agentx\_manager                    |
| message\_id            | message\_id                        |
| mode                   | permission                         |
| msgtype                | message\_type                      |
| name                   | path                               |
| name                   | path                               |
| nametype               | path\_type                         |
| new auid               | audit\_user\_id                    |
| new ses                | session\_id                        |
| new-disk               | disk                               |
| new-mem                | virtual\_memory\_size              |
| new-net                | hardware\_address                  |
| new-vcpu               | virtual\_cpu\_count                |
| new\_gid               | group\_id                          |
| new\_pe                | pe                                 |
| new\_pi                | pi                                 |
| new\_pp                | pp                                 |
| oauid                  | user                               |
| obj                    | object                             |
| obj\_gid               | object\_group\_id                  |
| obj\_lev\_high         | object\_level\_high                |
| obj\_lev\_low          | object\_level\_low                 |
| obj\_role              | role                               |
| obj\_uid               | object\_id                         |
| obj\_user              | user                               |
| ocomm                  | command                            |
| ogid                   | owner\_group\_id                   |
| ogid                   | owner\_group\_id                   |
| old auid               | old\_audit\_user\_id               |
| old ses                | old\_session\_id                   |
| old-disk               | old\_disk                          |
| old-mem                | old\_memory                        |
| old-net                | old\_hardware\_address             |
| old-vcpu               | old\_cpu\_count                    |
| old\_prom              | old\_flag                          |
| op                     | action                             |
| opid                   | target\_process\_id                |
| oses                   | target\_session\_id                |
| ouid                   | user\_id                           |
| path                   | path                               |
| perm                   | permission                         |
| pid                    | process\_id                        |
| ppid                   | parent\_process\_id                |
| prom                   | flag                               |
| proto                  | protocol                           |
| rdev                   | recorded\_device\_id               |
| record\_id             | record\_id                         |
| res                    | status                             |
| result                 | status                             |
| rport                  | source\_port                       |
| rule\_description      | rule\_description                  |
| rule\_firedtimes       | rule\_trigger\_count               |
| rule\_frequency        | rule\_frequency                    |
| rule\_gdpr             | gdpr                               |
| rule\_gpg13            | gpg13                              |
| rule\_groups           | rule\_group                        |
| rule\_hipaa            | hipaa                              |
| rule\_id               | rule\_trigger\_id                  |
| rule\_level            | rule\_level                        |
| rule\_mail             | rule\_mail                         |
| rule\_mitre\_id        | attack\_id                         |
| rule\_mitre\_tactic    | attack\_category                   |
| rule\_mitre\_technique | attack\_tag                        |
| rule\_nist\_800\_53    | nist\_800\_53                      |
| rule\_pci\_dss         | pci\_dss                           |
| rule\_tsc              | tsc                                |
| saddr                  | socket\_address                    |
| sauid                  | sender\_audit\_user\_id            |
| scontext               | source\_context                    |
| ses                    | session\_id                        |
| sgid                   | set\_group\_id                     |
| sig                    | signal\_count                      |
| size                   | datasize                           |
| spid                   | sent\_process\_id                  |
| subj                   | subject                            |
| subj\_clr              | subject\_clearance                 |
| subj\_role             | role                               |
| subj\_sen              | sensitivity                        |
| subj\_user             | user                               |
| subject                | context subject                    |
| success                | is\_success                        |
| suid                   | set\_user\_id                      |
| syscall                | system\_call\_id                   |
| tclass                 | target\_class                      |
| tcontext               | target\_context                    |
| terminal               | terminal                           |
| timestamp              | event\_received\_ts                |
| tty                    | terminal\_type                     |
| type                   | event\_type                        |
| uid                    | user\_id                           |
| user pid               | process\_id                        |
| vm                     | virtual\_machine                   |

### **File Integrity Monitoring**

| **Unix Field**                 | **Logpoint Field**     |
| ------------------------------ | ---------------------- |
| Author                         | author                 |
| Command                        | command                |
| Data                           | data                   |
| Description                    | description            |
| Duration                       | duration               |
| Priority                       | priority               |
| URI                            | url                    |
| UserId                         | user\_id               |
| agent\_id                      | agentx\_agent\_id      |
| agent\_ip                      | agentx\_agent\_address |
| agent\_name                    | agentx\_agent          |
| decoder\_name                  | agentx\_decoder        |
| manager\_name                  | agentx\_manager        |
| rule\_firedtimes               | rule\_trigger\_count   |
| rule\_gdpr                     | gdpr                   |
| rule\_gpg13                    | gpg13                  |
| rule\_groups                   | rule\_group            |
| rule\_hipaa                    | hipaa                  |
| rule\_id                       | rule\_trigger\_id      |
| rule\_mitre\_id                | attack\_id             |
| rule\_mitre\_tactic            | attack\_category       |
| rule\_mitre\_technique         | attack\_tag            |
| rule\_nist\_800\_53            | nist\_800\_53          |
| rule\_pci\_dss                 | pci\_dss               |
| rule\_tsc                      | tsc                    |
| syscheck\_arch                 | architecture           |
| syscheck\_attrs\_after         | attribute              |
| syscheck\_audit\_process\_id   | process\_id            |
| syscheck\_audit\_process\_name | process                |
| syscheck\_audit\_user\_id      | user\_id               |
| syscheck\_audit\_user\_name    | user                   |
| syscheck\_changed\_attributes  | changed\_attribute     |
| syscheck\_diff                 | changed\_content       |
| syscheck\_entry\_type          | registry\_entry\_type  |
| syscheck\_event                | action                 |
| syscheck\_gid\_after           | group\_id              |
| syscheck\_gname\_after         | group                  |
| syscheck\_inode\_after         | inode                  |
| syscheck\_md5\_after           | hash                   |
| syscheck\_md5\_before          | old\_hash              |
| syscheck\_mode                 | mode                   |
| syscheck\_mtime\_after         | modification\_ts       |
| syscheck\_mtime\_before        | old\_modification\_ts  |
| syscheck\_path                 | path                   |
| syscheck\_perm\_after          | permission             |
| syscheck\_sha1\_after          | hash\_sha1             |
| syscheck\_sha1\_before         | old\_hash\_sha1        |
| syscheck\_sha256\_after        | hash\_sha256           |
| syscheck\_sha256\_before       | old\_hash\_sha256      |
| syscheck\_size\_after          | datasize               |
| syscheck\_size\_before         | old\_datasize          |
| syscheck\_uid\_after           | uid                    |
| syscheck\_uname\_after         | owner                  |
| syscheck\_value\_name          | registry\_value\_name  |
| syscheck\_value\_type          | registry\_value\_type  |
| syscheck\_win\_perm\_after     | permission             |
| syscheck\_win\_perm\_before    | old\_permission        |
| timestamp                      | event\_received\_ts    |
| data\_parameters\_program      | program                |
| data\_parameters\_keys         | parameter\_key         |
| data\_origin\_name             | origin                 |
| data\_version                  | version                |
| data\_command                  | command                |
| hostname                       | host                   |
| log\_type                      | log\_level             |
| rule\_description              | rule\_description      |
| rule\_frequency                | rule\_frequency        |
| rule\_level                    | rule\_level            |
| rule\_mail                     | rule\_mail             |

### **Security Configuration Assessment**

| **Unix Field**                              | **Logpoint Field**               |
| ------------------------------------------- | -------------------------------- |
| Author                                      | author                           |
| Command                                     | command                          |
| Data                                        | data                             |
| Description                                 | description                      |
| Duration                                    | duration                         |
| Priority                                    | priority                         |
| URI                                         | url                              |
| UserId                                      | user\_id                         |
| agent\_id                                   | agentx\_agent\_id                |
| agent\_ip                                   | agentx\_agent\_address           |
| agent\_name                                 | agentx\_agent                    |
| check\_compliance\_gpg\_13                  | check\_compliance\_gpg13         |
| check\_references                           | check\_reference                 |
| check\_rules                                | check\_rule                      |
| data\_sca\_check\_compliance\_cis\_csc      | check\_compliance\_cis\_csc      |
| data\_sca\_check\_compliance\_hipaa         | check\_compliance\_hipaa         |
| data\_sca\_check\_compliance\_nist\_800\_53 | check\_compliance\_nist\_800\_53 |
| data\_sca\_check\_compliance\_pci\_dss      | check\_compliance\_pci\_dss      |
| data\_sca\_check\_compliance\_tsc           | check\_compliance\_tsc           |
| data\_sca\_check\_description               | check\_description               |
| data\_sca\_check\_file                      | check\_file                      |
| data\_sca\_check\_id                        | check\_id                        |
| data\_sca\_check\_rationale                 | check\_rationale                 |
| data\_sca\_check\_reason                    | check\_reason                    |
| data\_sca\_check\_references                | check\_reference                 |
| data\_sca\_check\_registry                  | check\_registry                  |
| data\_sca\_check\_remediation               | check\_remediation               |
| data\_sca\_check\_result                    | check\_result                    |
| data\_sca\_check\_status                    | check\_status                    |
| data\_sca\_check\_title                     | check\_title                     |
| data\_sca\_description                      | policy\_description              |
| data\_sca\_failed                           | fail\_count                      |
| data\_sca\_file                             | policy\_file                     |
| data\_sca\_invalid                          | invalid\_count                   |
| data\_sca\_passed                           | pass\_count                      |
| data\_sca\_policy                           | policy                           |
| data\_sca\_policy\_id                       | policy\_id                       |
| data\_sca\_scan\_id                         | scan\_id                         |
| data\_sca\_score                            | scan\_score                      |
| data\_sca\_total\_checks                    | total\_count                     |
| data\_sca\_type                             | scan\_type                       |
| decoder\_name                               | agentx\_decoder                  |
| description                                 | policy\_description              |
| end\_time                                   | end\_ts                          |
| failed                                      | fail\_count                      |
| file                                        | policy\_file                     |
| invalid                                     | invalid\_count                   |
| manager\_name                               | agentx\_manager                  |
| name                                        | policy                           |
| passed                                      | pass\_count                      |
| policies                                    | policy\_id                       |
| references                                  | policy\_reference                |
| rule\_cis                                   | cis                              |
| rule\_cis\_csc                              | cis\_csc                         |
| rule\_firedtimes                            | rule\_trigger\_count             |
| rule\_gdpr                                  | gdpr                             |
| rule\_gdpr\_IV                              | gdpr\_iv                         |
| rule\_gpg13                                 | gpg13                            |
| rule\_gpg\_13                               | gpg13                            |
| rule\_groups                                | rule\_group                      |
| rule\_hipaa                                 | hipaa                            |
| rule\_id                                    | rule\_trigger\_id                |
| rule\_mitre\_id                             | attack\_id                       |
| rule\_mitre\_tactic                         | attack\_category                 |
| rule\_mitre\_technique                      | attack\_tag                      |
| rule\_nist\_800\_53                         | nist\_800\_53                    |
| rule\_pci\_dss                              | pci\_dss                         |
| rule\_tsc                                   | tsc                              |
| score                                       | scan\_score                      |
| start\_time                                 | start\_ts                        |
| timestamp                                   | event\_received\_ts              |
| total\_checks                               | total\_count                     |
| type                                        | scan\_type                       |

### **Unix Generic Log Taxonomy**

| **Unix Field**         | **Logpoint Field**     |
| ---------------------- | ---------------------- |
| agent\_id              | agentx\_agent\_id      |
| agent\_ip              | agentx\_agent\_address |
| agent\_name            | agentx\_agent          |
| decoder\_name          | agentx\_decoder        |
| hostname               | host                   |
| log\_type              | log\_level             |
| manager\_name          | agentx\_manager        |
| rule\_description      | rule\_description      |
| rule\_firedtimes       | rule\_trigger\_count   |
| rule\_frequency        | rule\_frequency        |
| rule\_gdpr             | gdpr                   |
| rule\_gpg13            | gpg13                  |
| rule\_groups           | rule\_group            |
| rule\_hipaa            | hipaa                  |
| rule\_id               | rule\_trigger\_id      |
| rule\_level            | rule\_level            |
| rule\_mail             | rule\_mail             |
| rule\_mitre\_id        | attack\_id             |
| rule\_mitre\_tactic    | attack\_category       |
| rule\_mitre\_technique | attack\_tag            |
| rule\_nist\_800\_53    | nist\_800\_53          |
| rule\_pci\_dss         | pci\_dss               |
| rule\_tsc              | tsc                    |
| timestamp              | event\_received\_ts    |

### **Active Response Taxonomy**

| **Unix Field**            | **Logpoint Field**     |
| ------------------------- | ---------------------- |
| agent\_id                 | agentx\_agent\_id      |
| agent\_ip                 | agentx\_agent\_address |
| agent\_labels\_os\_name   | agentx\_agent\_os      |
| agent\_name               | agentx\_agent          |
| data\_parameters\_program | program                |
| data\_parameters\_keys    | parameter\_key         |
| data\_origin\_module      | origin\_module         |
| data\_origin\_name        | origin                 |
| data\_version             | version                |
| data\_command             | command                |
| decoder\_name             | agentx\_decoder        |
| manager\_name             | agentx\_manager        |
| hostname                  | host                   |
| log\_type                 | log\_level             |
| rule\_description         | rule\_description      |
| rule\_firedtimes          | rule\_trigger\_count   |
| rule\_frequency           | rule\_frequency        |
| rule\_gdpr                | gdpr                   |
| rule\_gpg13               | gpg13                  |
| rule\_groups              | rule\_group            |
| rule\_hipaa               | hipaa                  |
| rule\_id                  | rule\_trigger\_id      |
| rule\_level               | rule\_level            |
| rule\_mail                | rule\_mail             |
| rule\_mitre\_id           | attack\_id             |
| rule\_mitre\_tactic       | attack\_category       |
| rule\_mitre\_technique    | attack\_tag            |
| rule\_nist\_800\_53       | nist\_800\_53          |
| rule\_pci\_dss            | pci\_dss               |
| rule\_tsc                 | tsc                    |
| timestamp                 | event\_received\_ts    |
