Management Event schema

Use this reference to identify the fields available in the managementevent schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property	Value
Schema name	ManagementEvent
Parser field prefix	ManagementEvent
Supports custom parsers	Yes
Schema components	ManagementInterface

Schema components

ManagementEvent.ManagementInterface

Represents an enum that identifies different management providers.

Name	Number	Description
UNKNOWN	0
WMI	1	Windows Management Instrumentation
SUDO	2	SUDO

Schema fields

Normalized Field	Type	Parser Field	Description
resource_id	string	resourceId$	Full resource string identifying the record.
tenant_id	string	tenantId$	ID of the tenant.
sensor_type	string	sensorType$	Type of device that generated this event.
sensor_event_id	string	sensorEventId$	Event ID of `original_data` assigned by the sensor.
sensor_tenant	string	sensorTenant$	A customer ID supplied by the application that originated the data.
sensor_id	string	sensorId$	An ID for the data supplied by the application that originated it.
sensor_cpe	string	sensorCpe$	CPE of the platform producing the alert.
original_data	string	originalData$	Original, unadulterated data prior to any transformation.
event_time_usec	uint64	eventTimeUsec$	Event time in microseconds (µs).
ingest_time_usec	uint64	ingestTimeUsec$	Ingest time in microseconds (µs).
event_time_fidelity	TimeFidelity	eventTimeFidelity$	Specifies the original precision of the time used to populate `event_time_usec`.
host_id	string	hostId$	The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
sensor_version	string	sensorVersion$	The agent version as string.
type	ManagementEvent.ManagementInterface	type$	Defines the source the type of management system that produced this event.
remote_operation	bool	remoteOperation$	Indicates if this management event was triggered by a remote host.
operation_id	uint64	operationId$	Provides an ID to identify the specific type of operation being performed. This ID is not unique to specific events within a provider but is unique.
operation_group_id	uint64	operationGroupId$	Used to group and connect multiple events together.
operation_name	string	operationName$	A name identifying the operation being performed.
operation	string	operation$	The operation being performed. This may be a summary or other human readable information that should provide more insights beyond what `operation_name` or `operation_id` may contain.
query	string	query$	The query run by the management event.
query_language	string	queryLanguage$	The language in which the query is being run.
command	string	command$	The command being run as part of the operation.
result	string	result$	The code or message that conveys information about the final result of the operation.
namespace	string	namespace$	The definition of a namespace is dependent on the type of management interface in use. For WMI, this refers to a Windows namespace.
filters	repeated string	filters$	The names of any filters that were applied to or that allowed this event to be emitted.
consumers	repeated string	consumers$	The names of any known downstream consumers of this event.
possible_cause	string	possibleCause$	Contains information about the potential cause of a given management event. Not all management events will have this populated, but it may be populated when command, query, operation, etc. do not provide sufficient information by themselves.
channel	string	channel$	The provider-specific channel in which the event was emitted. For example, ETW will have channels that describe the WMI activity being performed.
event_id	uint64	eventId$	Contains a provider-specific event ID. This is likely more general than `operation_id` and may be useful for filtering purposes.
script	string	script$	If a script was run as part of a management event, this field will contain the script's contents, if available.
script_language	string	scriptLanguage$	If a script was run as part of a management event, this field will contain the script's language, if available.
script_file_path	string	scriptFilePath$	If a script was run as part of a management event, this field will contain the script's file path, if available.
username	string	username$	The name of the user the operation was run under.
client_hostname	string	clientHostname$	The host that ran the tool that triggered the management event. If the operation is being performed remotely, these values will be identical to the target host.
client_hostname_fqdn	string	clientHostnameFqdn$
target_hostname	string	targetHostname$	The host on which the management command, modification, etc. was performed. If the operation is being performed remotely, these values will be different from the client host fields.
target_hostname_fqdn	string	targetHostnameFqdn$
client_process_correlation_id	ProcessCorrelationID	clientProcessCorrelationId	Contains a reference to a process linked with this event. If `remote_operation` is true, then this process will be a process create time on another host.
created_process_correlation_id	ProcessCorrelationID	createdProcessCorrelationId$	Contains a reference to a process linked with this event.
client_process_create_time_usec	uint64	clientProcessCreateTimeUsec$	Create time of the client process. If `remote_operation` is true, then this will be the process create time on a remote machine.
client_process_id	uint64	clientProcessId$	Process ID of the client process. If `remote_operation` is true, then this will be the process create time on a remote machine.
created_process_create_time_usec	uint64	createdProcessCreateTimeUsec$	Create time of a process created by the management command.
created_process_id	uint64	creaetedProcessId$	Process ID of a process created by the management command.