Security Log Format Field References

Each reference covers one log format LogTriage parses: what a record represents, how to export it, every field that matters for detection, the parsing traps that silently drop data, and detection ideas tied to published Sigma rules. Field names and sample records are checked against real files in the LogTriage parser test corpus, so what you see here is what the parser actually reads.

• AWS VPC Flow Logs Cloud Network · 14 fields

  One record per network flow through an elastic network interface in each aggregation window: which addresses talked on which ports, how much data moved, and whether security groups and network ACLs accepted or rejected it.

• CrowdStrike Falcon EDR · 16 fields

  One JSON record per event a Falcon sensor reported — a process launch, network connection, DNS lookup, logon, or a detection raised by the Falcon cloud — identified by event_simpleName and tied to one sensor by aid.

• Duo Security Identity · 16 fields

  One record per Duo event — usually an authentication: which user was challenged, with which factor, from which device and IP, for which application, and whether the attempt was allowed, denied or reported as fraud. Administrator actions appear in the same export with a different shape.

• Azure AD Sign-In Logs Identity · 15 fields

  One record per sign-in attempt to Microsoft Entra ID: who signed in, from where, with which client, what Conditional Access decided and how it ended. The primary evidence for identity attacks against Microsoft 365.

• Kubernetes Audit Log Cloud-Native · 16 fields

  One JSON event per request handled by the Kubernetes API server: who called it, from which address, which verb against which object, what the authorizer decided and how the server responded.

• Okta System Log Identity · 16 fields

  One record per event in an Okta org — a login attempt, a factor verification, a logout, an account lockout — showing who or what acted, the client and IP behind it, and whether it succeeded.

• Sysmon Endpoint · 16 fields

  One record per piece of endpoint activity Sysmon was configured to watch — a process start, a network connection, a handle opened on another process, a DNS query — carrying the image path, command line, user and parent that the built-in Windows logs leave out.