Skip to main content

Event and Threat Fields

Event and Threat fields can be used in search queries and detection queries within Policies. These fields represent metadata for every browser activity.

Getting Started​

To get started using extension fields, navigate to the Events page from the menu on the left side of your console. Click the magnifying glass icon to open the search area and use the search bar to search for events and extensions with various fields. Or use the Search Builder or Filter options on the right-side of the search bar to find certain fields.

Keep Aware Events Search Image: Events Search Bar

Fields Overview​

  • Popular Fields: Fields that tend to be the "go-to" for searching as they exist on almost all event types.
  • Destination Fields: Fields related to the website, application, or destination related to the event.
  • Source or Asset Fields: Every event has multiple fields associated with a User, a Browser, and a Device. Refer to Asset Fields for asset fields.
  • Risk & Context Fields: Fields that provide contextual information, such as SSL/TLS certificate information, WHOIS data, and custom Keep Aware scoring.
  • Activity-Specific Fields: Every activity type has unique metadata associated with those events.
  • Miscellaneous Event Fields: Fields that are present on most events and used for miscellaneous purposes.

Fields that tend to be the "go-to" for searching as they exist on almost all event types.

  • Activity Type: type | text | The browser activity or event type
  • Location: location | text | An alias for the hostname or extension ID associated with the event
  • Action: status | text | The action taken by Keep Aware for the event
  • Risk Score: score | number | A score (0-100) representing the risk of an event
  • Hits: hits | number | The number of unique activities for a location over a 3-month moving window, often used to represent the current rarity of a behavior
  • Category: category | text | List of content or extension categories associated with the event
  • Lists: lists | text | Custom lists associated with a domain, URL or extension
  • Policy: policy.label | text | Policy associated with the event
  • User: user.label | text | User associated with the event typically written as an email address

Activity Type​

Every event has an activity type. These types are important to consider when conducting searches, investigations, and forming policy.

  • Activity Type: type | text | The browser activity or event type
    • Values: page, login, upload, download, link, install_extension, enable_extension, uninstall_extension, input, copy, paste, report, request, signal

For fields present in only specific activity-type events, refer to Activity-Specific Fields.

Destination Fields​

Fields related to the website, application, or destination related to the event.

  • domain | text | Domain name associated with the event
  • url | text | URL less query parameters
  • port | number | Port of tab/webpage event
  • tld | text | Domain TLD
  • protocol | text | Protocol of a tab/webpage event
  • app | text | App identifier associated with event
  • page | text | Title of a tab

Source or Asset Fields​

Every event has multiple fields associated with a User, a Browser, and a Device. Refer to Asset Fields for an exhaustive list of these fields.

Activity-Specific Fields​

Page Fields​

  • dom.alinks | number | Number of links on a webpage | Note: Extensible
  • dom.body_size | number | Body size of a webpage | Note: Extensible
  • dom.desc | text | Description of a webpage
  • dom.domain_spine | number | Ratio of same-origin URLs to source domain
  • dom.fields.count | number | Number of fields detected on a webpage
  • dom.fields.email | boolean | Whether an email field was detected on first load
  • dom.fields.password | boolean | Whether a password field was detected on first load
  • dom.force | boolean | Whether a webpage update was forced by Keep Aware
  • dom.hDiff | number | Scrollable height of a webpage | Note: Extensible
  • dom.head_size | number | Header size of a webpage
  • dom.images | number | Number of images on a webpage | Note: Extensible
  • dom.keywords | text | Extracted keywords on a webpage | Note: Opt-In Only
  • dom.link_spine | number | Ratio of same-origin URLs to source hostname
  • dom.login | boolean | Whether a sign in prompt was detected on first load
  • dom.metas | number | Number of metadata tags on a webpage
  • dom.ogurl | text | OGURL of the webpage
  • dom.pagesize | number | Total webpage size
  • dom.redirect.host | text | Hostnames of the source of the webpage load
  • dom.redirect.pathname | text | Pathnames of the source of the webpage load
  • dom.rgx.copyright.value | text | Website Copyright
  • dom.alinks | number | Number of links on a webpage
  • dom.body_size | number | Body size of a webpage
  • dom.desc | text | Description of a webpage
  • dom.domain_spine | number | Ratio of same-origin URLs to source domain | Note: Extensible
  • dom.fields.count | number | Number of fields detected on a webpage
  • dom.fields.email | boolean | Whether an email field was detected on first load
  • dom.fields.password | boolean | Whether a password field was detected on first load
  • dom.force | boolean | Whether a webpage update was forced by Keep Aware
  • dom.hDiff | number | Scrollable height of a webpage
  • dom.head_size | number | Header size of a webpage
  • dom.hlinks | number | Number of links in the header of a webpage
  • dom.images | number | Number of images on a webpag
  • dom.xpath | text | XPATH selector values

Page RegEx Selectors

  • dom.rgx.copyright.value | text | Website Copyright
  • dom.xpath | text | XPath selector of a page event | Note: Extensible

Custom page logic can be implemented and applied per tenant.

Download Fields​

  • download.bypass | boolean | Whether a notice was skipped
  • download.filename | text | Absolute local path
  • download.finalUrl | text | The absolute URL that this download is being made from, after all redirects.
  • download.id | number | An identifier that is persistent across browser sessions.
  • download.incognito | boolean | False if this download is recorded in the history, true if it is not recorded.
  • download.mime | text | The file's MIME type
  • download.mixedState | text | -
  • download.referrer | text | Absolute URL
  • download.startTime | date | The time when the download began in ISO 8601 format
  • download.totalBytes | number | Number of bytes in the whole file, without considering file compression, or -1 if unknown
  • download.sha256 | text | File SHA-256 hash
  • download.lists | text | Lists associated with file hash

Upload Fields​

  • upload.bypass | boolean | Whether or not a notice was skipped
  • upload.count | number | Number of files uploaded
  • upload.files.lastModified | number | List of last modified file dates
  • upload.files.name | text | File name
  • upload.files.size | number | File size, in bytes
  • upload.files.type | text | File MIME types
  • upload.files.sha256 | text | File SHA-256 hash
  • upload.files.lists | text | Lists associated with file hash
  • upload.files.matches | text | Input selectors that match the file contents
  • upload.name | text | Element name where upload takes place
  • upload.size | number | Total upload size, in bytes

Login, Input, Copy, and Paste Fields​

  • input.bridge | text | Events bridged to an input for SSO and MFA linking
  • input.confidence | number | Confidence that an input is complete and related to a corporate account
  • input.corp | number | Whether a corporate account was detected in the input
  • input.fill | text | Password/Input manager used to auto-fill an input
  • input.from | text | The stage that an input that was captured
  • input.guesses_log10 | number | Password guess strength — estimated guesses needed to crack a password, on a log10 scale. See Password Strength
  • input.score | number | Password strength — a value from 0 to 4. See Password Strength
  • input.matches | text | DLP and regex patterns that match the input | Note: Extensible
  • input.mfa | boolean | Whether a MFA event is linked with this event
  • input.name | text | Name of a input field
  • input.status | text | User action taken on an input field
  • input.totp | boolean | Whether a TOTP is associated with the input
  • input.type | text | Type of an input event
  • input.value | text | Value of an input event (email address / username)
  • input.xpath | text | XPath selector of an input event

Input RegEx Selectors

  • input.matches | text | DLP and RGX patterns that match the input | Note: Extensible.
  • input.xpath | text | XPath selector of an input event | Note: Extensible

Custom page logic can be implemented and applied per tenant.

  • link.category | text | Category associated with link hostname
  • link.host | text | Link hostname
  • link.hostname | text | Link hostname
  • link.lists | text | Lists associated with link hostname
  • link.text | text | Text of a Link

Extension Fields​

Web Application Account Fields​

Threat Fields​

Fields specific to browsing events that have been classified as a threat by a Policies.

  • actions.console | text | Console actions triggered by event
  • actions.integration | text | Integrations triggered by an event
  • actions.pattern | text | Whether the event suppressed other events
  • actions.reporting | boolean | Reporting actions triggered by event
  • actions.user | text | User actions triggered by event
  • cooldown | number | Seconds to cooldown before a similar event triggers a pattern
  • event.ids | text | Event IDs associated with a threat
  • name | text | Name of a threat | Note: Is the same value as the triggering pattern's pattern.name
  • reviewed | boolean | Whether a threat has been reviewed
  • short | text | Short description of a threat

Risk & Context Fields​

  • risk.certificate.issuer.C | text | TLS Certificate Information
  • risk.certificate.issuer.CN | text | TLS Certificate Information
  • risk.certificate.issuer.emailAddress | text | TLS Certificate Information
  • risk.certificate.issuer.L | text | TLS Certificate Information
  • risk.certificate.issuer.O | text | TLS Certificate Information
  • risk.certificate.issuer.organizationIdentifier | text | TLS Certificate Information
  • risk.certificate.issuer.OU | text | TLS Certificate Information
  • risk.certificate.issuer.ST | text | TLS Certificate Information
  • risk.certificate.serialNumber | text | TLS Certificate Information
  • risk.certificate.subject.businessCategory | text | TLS Certificate Information
  • risk.certificate.subject.C | text | TLS Certificate Information
  • risk.certificate.subject.CN | text | TLS Certificate Information
  • risk.certificate.subject.DC | text | TLS Certificate Information
  • risk.certificate.subject.jurisdictionC | text | TLS Certificate Information
  • risk.certificate.subject.jurisdictionL | text | TLS Certificate Information
  • risk.certificate.subject.jurisdictionST | text | TLS Certificate Information
  • risk.certificate.subject.L | text | TLS Certificate Information
  • risk.certificate.subject.O | text | TLS Certificate Information
  • risk.certificate.subject.organizationIdentifier | text | TLS Certificate Information
  • risk.certificate.subject.postalCode | text | TLS Certificate Information
  • risk.certificate.subject.ST | text | TLS Certificate Information
  • risk.certificate.subject.street | text | TLS Certificate Information
  • risk.certificate.valid_from | number | TLS Certificate Information
  • risk.certificate.valid_to | number | TLS Certificate Information
  • risk.descriptors | text | List of Text Risk Descriptors Associated with Event | Note: Extensible
  • risk.geo.asn | number | Geographic Information for the Destination
  • risk.geo.city_name | text | Geographic Information for the Destination
  • risk.geo.continent_name | text | Geographic Information for the Destination
  • risk.geo.country_iso_code | text | Geographic Information for the Destination
  • risk.geo.country_name | text | Geographic Information for the Destination
  • risk.geo.ip | text | Geographic Information for the Destination
  • risk.geo.location.lat | text | Geographic Information for the Destination
  • risk.geo.location.lon | text | Geographic Information for the Destination
  • risk.geo.network | text | Geographic Information for the Destination
  • risk.geo.organization_name | text | Geographic Information for the Destination
  • risk.geo.region_iso_code | text | Geographic Information for the Destination
  • risk.geo.region_name | text | Geographic Information for the Destination
  • risk.ip | text | IP of the Destination
  • risk.permission.count | number | Number of Extension Permissions Requested
  • risk.permission.rarity_score | number | Permission Rarity Score
  • risk.permission.rarity_sum | number | Permission Rarity Sum/Multiple
  • risk.public.installs | number | Number of Public Extension Installs
  • risk.rank | number | Rank in the Top 1M domain names | Note: Beta - Currently top 10k
  • risk.reputation.installs | number | Number of organization installs of an extension
  • risk.vision | text | Login type detected visually, such as Microsoft or Google login pages
  • risk.whois.expiration | number | Number of months until domain expiration
  • risk.whois.months | number | Number of months since domain creation
  • risk.whois.registrant_org | text | Domain Registrar Organization
  • risk.whois.registrar | text | Domain Registrar Name

Miscellaneous Event Fields​

Fields that are present on each event irregardless of the activity type.

  • @timestamp | date | Timestamp of event
  • _id | text | Event ID
  • ka | text | Tenant ID of an event
  • session.prev_hit | text | Event ID of the previous event
  • session.tab | number | Tab ID of an event | Deprecated
  • status | text | Status of the event and whether it triggered a user action
  • type | text | Event Type
  • version | text | Keep Aware extension version

Fetch & API Call Fields​

  • A list of fetch fields can be provided on request

Signal Fields​

  • attachedTo | text | Responses attached to event
  • signal.category | text | Response signal category
  • signal.gid | text | Response signal ID

Examples​

Uploads to Sites Not Approved by IT​

Upload events where files were uploaded to a domain that's not been approved by IT. (Note: Replace the below domains with those approved by IT.)

type:"upload" AND NOT domain:("google.com" "office.com" "box.com")

Possible Phishing Threats Linked to a "Robert"​

Threats that are linked to users named robert where the threat is grouped in the phishing category.

type:"threat" AND user.label:*robert* AND pattern.category:"phishing"

Page Visits to Uncommon Location​

Page events by users to a web location that is uncommon (in this case, less than 10 recent visits) across your organization.

type:"page" AND hits:<10

Inputs on Risky Webpages or Young Domains​

Events where a user has input data into a webpage with a high risk score.

type:"input" AND (score:>80 OR risk.whois.months:<12)

Download Threats Marked as Reviewed​

Download threats that have been marked as reviewed by a Console User.

type:"threat" AND pattern.type:"download" AND reviewed:"true"

Threat events triggered by a Pattern related to Microsoft.

type:"threat" AND name:*Microsoft*

Table of Contents