Unknown observable data type.

Observable by Dictionary Type.
Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:
r2-d2.example.com.,
mx.example.com

Observable by Dictionary Type.
Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:
192.168.200.24,
2001:0db8:85a3:0000:0000:8a2e:0370:7334.

Observable by Dictionary Type.
Media Access Control (MAC) address. For example:
18:36:F3:98:4F:9A.

Observable by Dictionary Type.
User name. For example:
john_doe.

Observable by Dictionary Type.
Email address. For example:
john_doe@example.com.

Observable by Dictionary Type.
Uniform Resource Locator (URL) string. For example:
http://www.example.com/download/trouble.exe.

Observable by Dictionary Type.
File name. For example:
text-file.txt.

Observable by Dictionary Type.
Fingerprint. A value, in any format, that maps an arbitrarily large data item to a much shorter string that uniquely identifies the original data. Examples include cryptographic hashing of a file, code signing, and Network Protocol Fingerprinting (NPF).

Note about name. The type name file_hast_t and the caption "Hash" are used for legacy reasons. This type has been generalized from a file hash to a general fingerprint. The existing type name and caption were retained for backwards compatibility.

Observable by Dictionary Type.
Process name. For example:
Notepad.

Observable by Dictionary Type.
Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID.

Observable by Dictionary Type.
The TCP/UDP port number. For example:
80,
22.

Observable by Dictionary Type.
The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:
192.168.1.0/24,
2001:0db8:85a3:0000::/64

Observable by Dictionary Attribute.
The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used.

Observable by Dictionary Attribute.
The ISO 3166-1 Alpha-2 country code.

Note: The two letter country code should be capitalized. For example: US or CA.

Observable by Dictionary Attribute.
The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.

Observable by Dictionary Attribute.
The request header that identifies the operating system and web browser.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the CWE Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the CVE Object.

Observable by Dictionary Attribute.
The unique identifier of the user's credential. For example, AWS Access Key ID.

Observable by Object.
The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints.

Observable by Object.
The User object describes the characteristics of a user/person or a security principal.

Observable by Object.
The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.

Observable by Object.
The Uniform Resource Locator (URL) object describes the characteristics of a URL.

Observable by Object.
The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.

Observable by Object.
The Process object describes a running instance of a launched program.

Observable by Object.
The Geo Location object describes a geographical location, usually associated with an IP address.

Observable by Object.
The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

Observable by Object.
The registry key object describes a Windows registry key.

Observable by Object.
The registry value object describes a Windows registry value.

Observable by Object.
The Fingerprint object provides detailed information about a fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key, file content, or application implementation. It contains the algorithm or scheme and value of the fingerprint, enabling efficient and reliable identification of the associated data.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the User Object.

Observable by Object-Specific Attribute.
Object-specific attribute "name" for the Group Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Group Object.

Observable by Object-Specific Attribute.
Object-specific attribute "name" for the Account Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Account Object.

Observable by Dictionary Attribute.
The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated.

Observable by Dictionary Attribute.
The serial number that pertains to the object. See specific usage.

Observable by Object-Specific Attribute.
Object-specific attribute "name" for the Resource Details Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Process Entity Object.

Observable by Object-Specific Attribute.
Object-specific attribute "subject" for the Email Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Email Object.

Observable by Dictionary Attribute.
The email header Message-ID value, as defined by RFC 5322.

Observable by Object-Specific Attribute.
Object-specific attribute "name" for the Registry Value Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Advisory Object.

Observable by Dictionary Type.
The full path to the file. For example: For example:
c:\windows\system32\svchost.exe.

Observable by Dictionary Type.
Full path of registry key.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Device Object.

Observable by Object-Specific Attribute.
Object-specific attribute "uid" for the Network Endpoint Object.

The observable data type is not mapped. See the type attribute, which may contain data source specific value.