Skip to main content

Asset Fields

Asset fields can be used in search queries and detection queries within Patterns. These fields represent metadata for users, browsers, and operating systems.

Getting Started​

To get started using asset fields, navigate to the Users page from the menu on the left side of your console. Click the magnifying glass icon to open the search area and use the search bar to search for events and extensions with various fields. Or use the Search Builder or Filter options on the right-side of the search bar to find certain fields.

Keep Aware Events Search Image: Events Search Bar

  • user.label | text | Associated user label for the browser (Often the user's email address)
  • browser.id | text | Unique Browser ID
  • browser.name | text | Browser brand name
  • browser.version | text | Browser version
  • browser.os.name | text | Device OS version
  • device.hostname | text | Device hostname

User, Browser, and Device Fields​

User Fields

  • user.email | text | User email address for manual install type
  • user.geo.asn | number | ASN of the browser
  • user.geo.ip or user.ip.public | text | IP of the browser
  • user.geo.organization_name | text | Network Organization of the browser
  • user.geo.network | text | Network of the browser
  • user.groups | text | List of groups tied to browser
  • user.label | text | Associated user label for the browser (Often the user's email address)
  • user.id | text | Unique ID for the User
  • user.link | text | Associated user ID for the browser
  • user.profiles | text | List of profiles tied to browser
  • user.score | number | Weighted user risk score | Note: Beta
  • geo.city_name | text | Geographic Information for a User
  • geo.continent_name | text | Geographic Information for a User
  • geo.country_iso_code | text | Geographic Information for a User
  • geo.country_name | text | Geographic Information for a User
  • geo.location | text | Geographic Information for a User
  • geo.region_iso_code | text | Geographic Information for a User
  • geo.region_name | text | Geographic Information for a User

Browser and Device Fields

  • browser.name | text | Browser brand name
  • browser.id | text | Unique Browser ID
  • browser.os.name | text | Device OS name
  • browser.os.version | text | Device OS version
  • browser.version | text | Browser version
  • device.hostname | text | Device hostname
  • device.ipAddress | text | Device local IP address
  • device.lastUpdated | number | Device information updated timestamp
  • device.macAddress | text | Device mac address
  • device.user.name | text | Device domain user

Examples​

Events Linked to a "Robert"​

Events linked to users named Robert.

user.label:*robert* OR user.email:*robert*

Windows Devices with Certain Chrome Browser Versions​

Windows devices with Chrome browsers that are not the latest version, version 126.

browser.os.name:"Windows" AND browser.name:"Google Chrome" AND browser.version:<126

Table of Contents