NIDS schema

Use this reference to identify the fields available in the nids schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property	Value
Schema name	NIDS
Parser field prefix	NIDS
Supports custom parsers	Yes
Schema components	ThreatIntelligenceIndicators, VendorExtraContextEntry, Direction, Author

Schema components

Nids.ThreatIntelligenceIndicators

Normalized Field	Type	Parser Field	Description
type	string	type$	Type of TI, such as IP address, email address, URL, hash, malware, etc.
value	string	value$	Raw value of the TI indicator, such as `1.1.1.1`, `FAKEURL.COM`, etc.
category	string	category$	Category of the TI, such as Keylogger, backdoor, etc.
last_observation_time_usec	uint64	lastObservationTimeUsec$	Timestamp related to when TI was last curated.
source	string	source$	Human-readable source of the TI data, such as Microsoft TIC.
source_url	string	sourceUrl$	URL that provides information about the TI.
family	string	family$	Provider-generated malware family, such as `wannacry`, `notpetya`, etc.

Nids.VendorExtraContextEntry

Normalized Field	Type	Parser Field	Description
key	string	key$
value	string	value$

Nids.Direction

Name	Number	Description
UNKNOWN	0	Unused but required for Proto3.
INBOUND	1	When you have a flow to/from the security control itself.
OUTBOUND	2	Send.
CLIENT_TO_SERVER	3	When you get a flow from a security control inspecting a flow from point A to B. The security control is not a part of the conversation, just an observer. The security control only knows who is the initiator (client) of the connection and who is the receiver (server).
SERVER_TO_CLIENT	4

Nids.author

Name	Number	Description
DEFAULT_ORIGIN	0	Unused but required for Proto3.
VENDOR_OF_SENSOR	1	Whoever manufactured the `sensorType` is the author of this NIDS countermeasure.
SCWX_CTU	2	Denotes that the NIDS countermeasure is from the Counter Threat Unit.
EMERGING_THREATS	3	Denotes a countermeasure from Proofpoint Emerging Threats Rules. See their documentation.

Schema fields

Normalized Field	Type	Parser Field	Description
resource_id	string	resourceId$	Full resource string identifying the record.
tenant_id	string	tenantId$	ID of the tenant.
sensor_type	string	sensorType$	Type of device that generated this event.
sensor_event_id	string	sensorEventId$	Event ID of `original_data` assigned by the sensor.
sensor_tenant	string	sensorTenant$	A customer ID supplied by the application that originated the data.
sensor_id	string	sensorId$	An ID for the data supplied by the application that originated it.
sensor_cpe	string	sensorCpe$	CPE of the platform producing the alert.
original_data	string	originalData$	Original, unadulterated data prior to any transformation.
event_time_usec	uint64	eventTimeUsec$	Event time in microseconds (µs).
ingest_time_usec	uint64	ingestTimeUsec$	Ingest time in microseconds (µs).
event_time_fidelity	TimeFidelity	eventTimeFidelity$	Specifies the original precision of the time used to populate `event_time_usec`.
host_id	string	hostId$	The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
sensor_version	string	sensorVersion$	The agent version as string.
enrichments	Enrichments	enrichments$	Event enrichments.
generator_id	uint32	generatorId$	The generator ID that created the event (snort-based NIDS).
signature_id	uint32	signatureId$	The rule ID used to create the event.
signature_revision	uint32	signatureRevision$	The version of the rule.
policy_id	uint32	policyId$	The policy ID (snort-based NIDS).
message	string	message$	Title of the event.
classification	string	classification$	Event classification from classification.conf (snort-based NIDS).
priority	uint32	priority$	Priority placed on the event by the normalizer (based on vendor scale) where 1 is the highest priority and 5 is the lowest.
action	string	action$	How the packet was handled, such as DROP, SDROP, REJECT, ALERT, FW_TRUSTED, etc.
impact_flag	uint32	impactFlag$	Supersedes action.
blocked	uint32	blocked$	1 = NotBlocked, 2 = Blocked, 3 = WouldHaveBlocked.
vlan	uint32	vlan$	The extracted VLAN ID from the VLAN header in the alerting packet.
mpls_label	uint32	mplsLabel$	The extracted MPLS label from the MPLS header in the alerting packet.
snort_sensor_id	uint32	snortSensorId$	ID of the alerting device.
event_id	uint32	eventId$	ID of the event assigned by the sensor.
event_ref	uint32	eventRef$	Reference to another `event_id` being part of the conversation.
source_address	string	sourceAddress$	IP source address.
destination_address	string	destinationAddress$	IP destination address.
source_port	uint32	sourcePort$	TCP/UDP source port when protocol == 6
icmp_type	uint32	icmpType$	Type of ICMP event when protocol == 1.
destination_port	uint32	destinationPort$	TCP/UDP source port when protocol == 6
icmp_code	uint32	icmpCode$	ICMP code when protocol == 99.
protocol	uint32	protocol$	IP protocol number.
ttl	uint32	ttl$	IP packet time-to-live.
tos	string	tos$	IP packet type-of-service flags.
packet_id	uint32	packetId$	IP packet identifier.
ip_len	uint32	ipLen$	Length of the alerting packet's IP header.
dgm_len	uint32	dgmLen$	Packet datagram length for UDP packets.
flags	string	flags$	TCP flags ala tcpdump format string.
sequence	string	sequence$	TCP sequence of alerting packet.
ack	string	ack$	The TCP ACK.
window	string	window$	The size of the receive window.
tcp_len	uint32	tcpLen$	Size of the TCP packet.
tcp_options	string	tcpOptions$	String formatted TCP options.
pcap	bytes	bytes$	All packets associated with the alert. Base64-encoded and suitable for use (after decoding) with tcpdump, wireshark, etc.
pcapref	string	pcapref$	When PCAP field is not present, provides a text string explaining how to obtain the PCAP.
source_username	string	sourceUsername$	The username associated with the source.
destination_username	string	destinationUsername$	The username associated with the destination.
application_name	string	applicationName$	Application detected by Deep Packet Inspection engine.
is_custom_alert	NullableBoolean	isCustomAlert$	True when the detection reflects customer or tenant logic: wholly custom rules or indicators, or vendor-supplied templates, content packs, or building blocks that the tenant instantiated or materially configured (for example policies, named rule instances, thresholds, or scope). False when the alert is produced solely by vendor-default, uniformly deployed detection without meaningful per-tenant logic. Unknown when provenance cannot be determined from the source.
direction	Nids.Direction	direction$	Direction of the network traffic between the source and destination from the perspective of the sensor.
event_metadata	KeyValuePairsIndexed	eventMetadata$	Event metadata can be provided by the appliance to add context, such as URL/filename triggered on, BETTER schema information, etc.
countermeasure_author	Nids.author	countermeasureAuthor$	Who might have authored the event captured in the NIDS alert.
log_type	string	logType$	Vendor-provided definition of the log type.
src_ipblacklists	repeated string	srcIpblacklists$	Provides the names of blacklists matched by the source.
dest_ipblacklists	repeated string	destIpblacklists$	Provides the names of blacklists matched by the destination.
src_ipgeo_summary	GeoSummary	srcIpgeoSummary$	The geographic location of the source IP.
dest_ipgeo_summary	GeoSummary	destIpgeoSummary$	The geographic location of the destination IP.
threat_intelligence_indicators	repeated Nids.ThreatIntelligenceIndicators	threatIntelligenceIndicators$	Details related to threat intelligence indicators, such as category, last observed date, source, source URL, type, etc.

Note

When is_custom_alert is true:

Detection severity is not altered.
These detections are sent directly to the tenant for self-service and don't enter the MDR service queue because they are outside the scope of the Sophos MDR service. For details on MDR, see MDR.