Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-custom-parsers-schema-encrypt

Encrypt schema

Use this reference to identify the fields available in the encrypt schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property Value
Schema name Encrypt
Parser field prefix Encrypt
Supports custom parsers Yes
Schema components Protocol, TlsVersion

Schema components

Encrypt.Protocol

Certificate properties.

Name Number Description
UNKNOWN_PROTOCOL 0 Unused but required for Proto3.
TLS 1 TLS
SSL 2 SSL
SSH 3 SSH

Encrypt.TlsVersion

Name Number Description
TLS_UNKNOWN 0 Unused but required for Proto3.
TLS_10 1 TLSv1.0
TLS_11 2 TLSv1.1
TLS_12 3 TLSv1.2
TLS_13 4 TLSv1.3

Schema fields

Normalized Field Type Parser Field Description
resource_id string resourceId$ Full resource string identifying the record.
tenant_id string tenantId$ ID of the tenant.
sensor_type string sensorType$ Type of device that generated this event.
sensor_event_id string sensorEventId$ Event ID of original_data assigned by the sensor.
sensor_tenant string sensorTenant$ A customer ID supplied by the application that originated the data.
sensor_id string sensorId$ An ID for the data supplied by the application that originated it.
sensor_cpe string sensorCpe$ CPE of the platform producing the alert.
original_data string originalData$ Original, unadulterated data prior to any transformation.
event_time_usec uint64 eventTimeUsec$ Event time in microseconds (µs).
ingest_time_usec uint64 ingestTimeUsec$ Ingest time in microseconds (µs).
event_time_fidelity TimeFidelity eventTimeFidelity$ Specifies the original precision of the time used to populate event_time_usec.
host_id string hostId$ The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
protocol Encrypt.Protocol protocol$ The cryptographic protocol.
tls_version Encrypt.TlsVersion tlsVersion$ TLS Version.
certificate_version int32 certificateVersion$ Certificate version.
serial_number string serialNumber$ Certificate serial number.
certificate_subject string certificateSubject$ Certificate subject.
subject_order string subjectOrder$ Certificate subject order (C:ST:L:O:OU:CN:E).
certificate_issuer string certificateIssuer$ Certificate issuer.
issuer_order string issueOrder$ Certificate issuer order (C:ST:L:O:OU:CN:E).
subject_common_name string subjectCommonName$ Certificate subject Common Name (CN).
subject_organizational_unit string subjectOrganizationalUnit$ Certificate subject Organizational Unit (OU).
subject_organization string subjectOrganization$ Certificate subject Organization (O).
subject_locality string subjectLocality$ Certificate subject Locality (L).
subject_state string subjectState$ Certificate subject StateOrProvinceName (S).
subject_country string subjectCountry$ Certificate subject Country Name (C).
subject_email string subjectEmail$ Certificate subject Email Address.
issuer_common_name string issuerCommonName$ Certificate issuer Common Name (CN).
issuer_organizational_unit string issuerOrganizationalUnit$ Certificate issuer Organizational Unit (OU).
issuer_organization string issuerOrganization$ Certificate issuer Organization (O).
issuer_locality string issuerLocality$ Certificate issuer Locality (L).
issuer_state string issuerState$ Certificate issuer StateOrProvinceName (S).
issuer_country string issuerCountry$ Certificate issuer Country Name (C).
issuer_email string issuerEmail$ Certificate issuer Email Address.
valid_from_usec uint64 validFromUsec$ Timestamp before which certificate is not valid, in microseconds (µs).
valid_through_usec uint64 validThroughUsec$ Timestamp after which certificate is not valid, in microseconds (µs).
valid_from_string string validFromString$ Timestamp before which certificate is not valid, in string format (YYYYMMDDHHMMSSZ).
valid_through_string string validThroughString$ Timestamp after which certificate is not valid, in string format (YYYYMMDDHHMMSSZ).
ja3 string ja3$ JA3 hash.
ja3s string ja3s$ JA3S hash.
fingerprint FileHash fingerprint$ Certificate fingerprint.
sensor_version string sensorVersion$ The agent version as string.
source_address string sourceAddress$ IP address of the source.
destination_address string destinationAddress$ IP address of the destination.
source_port uint32 sourcePort$ Port of the source.
destination_port uint32 destinationPort$ Port of the destination.
source_ipgeo_summary GeoSummary sourceIpgeoSummary$ The geographic location of the source IP.
destination_ipgeo_summary GeoSummary destinationIpgeoSummary$ The geographic location of the destination IP.
event_type string eventType$ The event type provided by the data source.
event_metadata KeyValuePairsIndexed eventMetadata$ event_metadata provided by the data source to add context.