export declare const EcsFlat: { '@timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: ({ otlp_field: string; relation: string; stability: string; note?: undefined; } | { note: string; otlp_field: string; relation: string; stability: string; })[]; required: boolean; short: string; type: string; }; 'agent.build.original': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'agent.ephemeral_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'agent.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'agent.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'agent.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'agent.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.address': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'client.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; pattern: string; short: string; type: string; }; 'client.nat.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.nat.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.packets': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'client.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'client.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'client.user.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'cloud.account.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'cloud.account.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.availability_zone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'cloud.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.instance.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.instance.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.machine.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.origin.account.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.account.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.availability_zone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.instance.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.instance.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.machine.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.project.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.project.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.region': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.origin.service.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.project.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.project.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'cloud.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'cloud.region': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'cloud.service.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'cloud.target.account.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.account.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.availability_zone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.instance.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.instance.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.machine.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.project.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.project.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.region': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'cloud.target.service.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'container.cpu.usage': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; scaling_factor: number; short: string; type: string; }; 'container.disk.read.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'container.disk.write.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'container.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'container.image.hash.all': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'container.image.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'container.image.tag': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'container.labels': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; object_type: string; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'container.memory.usage': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; scaling_factor: number; short: string; type: string; }; 'container.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'container.network.egress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'container.network.ingress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'container.runtime': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'container.security_context.privileged': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'data_stream.dataset': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; }[]; short: string; type: string; }; 'data_stream.namespace': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; }[]; short: string; type: string; }; 'data_stream.type': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; }[]; short: string; type: string; }; 'destination.address': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'destination.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; pattern: string; short: string; type: string; }; 'destination.nat.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.nat.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.packets': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'destination.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'destination.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'destination.user.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'device.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'device.manufacturer': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'device.model.identifier': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'device.model.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'device.product.id': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'device.product.name': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'device.serial_number': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'device.type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'device.vendor.id': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'device.vendor.name': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dll.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'dll.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dll.origin_referrer_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dll.origin_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dll.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dll.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dll.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'dns.answers': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'dns.answers.class': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.answers.data': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.answers.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.answers.ttl': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.answers.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.header_flags': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'dns.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.op_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.question.class': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.question.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'dns.question.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.question.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.question.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.question.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.resolved_ip': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; type: string; }; 'dns.response_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'dns.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'ecs.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; }[]; required: boolean; short: string; type: string; }; 'email.attachments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; type: string; }; 'email.attachments.file.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.attachments.file.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'email.attachments.file.mime_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.attachments.file.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.attachments.file.size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.bcc.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'email.cc.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'email.content_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.delivery_timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.direction': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.from.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'email.local_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.message_id': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.origination_timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'email.reply_to.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'email.sender.address': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; synthetic_source_keep: string; type: string; }; 'email.subject': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'email.to.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'email.x_mailer': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'entity.target.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.target.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'entity.target.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'error.code': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'error.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'error.message': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'error.stack_trace': { dashed_name: string; description: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'error.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'event.action': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.agent_id_status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.category': { allowed_values: { description: string; expected_event_types: string[]; name: string; }[]; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'event.code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.created': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.dataset': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.duration': { dashed_name: string; description: string; flat_name: string; format: string; input_format: string; level: string; name: string; normalize: never[]; output_format: string; output_precision: number; short: string; type: string; }; 'event.end': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.ingested': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.kind': { allowed_values: { description: string; name: string; }[]; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.module': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.original': { dashed_name: string; description: string; doc_values: boolean; example: string; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.outcome': { allowed_values: { description: string; name: string; }[]; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.reason': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.risk_score': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.risk_score_norm': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.sequence': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.severity': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.start': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.timezone': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'event.type': { allowed_values: { description: string; name: string; }[]; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'event.url': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'faas.coldstart': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'faas.execution': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'faas.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'faas.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'faas.trigger.request_id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'faas.trigger.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'faas.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.accessed': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.attributes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'file.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'file.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.created': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.ctime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.device': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.drive_letter': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.elf.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.byte_order': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.cpu_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.creation_date': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.exports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.elf.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.abi_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.class': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.data': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.entrypoint': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.object_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.os_abi': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.header.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.elf.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.chi2': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.flags': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.physical_offset': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.virtual_address': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.segments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.elf.segments.sections': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.segments.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.elf.shared_libraries': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.elf.telfhash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.fork_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.gid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.group': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.inode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.macho.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.macho.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.macho.symhash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.mime_type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.mode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.mtime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.origin_referrer_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.origin_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.owner': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'file.target_path': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'file.uid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'file.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'file.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'gen_ai.agent.description': { beta: string; dashed_name: string; description: string; doc_values: boolean; example: string; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.agent.id': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.agent.name': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.operation.name': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.output.type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.choice.count': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.encoding_formats': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.frequency_penalty': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.max_tokens': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.model': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.presence_penalty': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.seed': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.stop_sequences': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.temperature': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.top_k': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.request.top_p': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.response.finish_reasons': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.response.id': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.response.model': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.system': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.token.type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.tool.call.id': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.tool.name': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.tool.type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.usage.input_tokens': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'gen_ai.usage.output_tokens': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'host.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.boot.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'host.cpu.usage': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; scaling_factor: number; short: string; type: string; }; 'host.disk.read.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.disk.write.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'host.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.hostname': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'host.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'host.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'host.network.egress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.network.egress.packets': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.network.ingress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.network.ingress.packets': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'host.os.family': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.full': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.kernel': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.platform': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.os.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.pid_ns_ino': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'host.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.boot.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.cpu.usage': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; scaling_factor: number; short: string; type: string; }; 'host.target.disk.read.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.disk.write.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.hostname': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'host.target.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'host.target.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.network.egress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.network.egress.packets': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.network.ingress.bytes': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.network.ingress.packets': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.family': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.full': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.kernel': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.platform': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.os.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.pid_ns_ino': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.target.uptime': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'host.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'host.uptime': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'http.request.body.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'http.request.body.content': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'http.request.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'http.request.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'http.request.method': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: ({ attribute: string; relation: string; stability: string; note?: undefined; } | { attribute: string; note: string; relation: string; stability: string; })[]; short: string; type: string; }; 'http.request.mime_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'http.request.referrer': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'http.response.body.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'http.response.body.content': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'http.response.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'http.response.mime_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'http.response.status_code': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'http.version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: ({ attribute: string; relation: string; stability: string; note?: undefined; } | { attribute: string; note: string; relation: string; stability: string; })[]; short: string; type: string; }; labels: { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; object_type: string; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'log.file.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'log.level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { otlp_field: string; relation: string; stability: string; }[]; short: string; type: string; }; 'log.logger': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.origin.file.line': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.origin.file.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.origin.function': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.appname': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.facility.code': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.facility.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.hostname': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.msgid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.priority': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.procid': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.severity.code': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.severity.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.structured_data': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'log.syslog.version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; message: { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { note: string; otlp_field: string; relation: string; stability: string; }[]; short: string; type: string; }; 'network.application': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.community_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.direction': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.forwarded_ip': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.iana_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.inner': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.inner.vlan.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'network.inner.vlan.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'network.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.packets': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'network.protocol': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'network.transport': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'network.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'network.vlan.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'network.vlan.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.egress.interface.alias': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress.interface.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress.interface.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress.vlan.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress.vlan.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.egress.zone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.hostname': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.ingress': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.ingress.interface.alias': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.ingress.interface.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.ingress.interface.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.ingress.vlan.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.ingress.vlan.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.ingress.zone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'observer.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'observer.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.os.family': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.full': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.kernel': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.platform': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.os.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'observer.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.serial_number': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.vendor': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'observer.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.api_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.cluster.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.cluster.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.cluster.url': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.cluster.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'orchestrator.namespace': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.resource.annotation': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'orchestrator.resource.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.resource.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'orchestrator.resource.label': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'orchestrator.resource.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.resource.parent.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.resource.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'orchestrator.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'organization.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'organization.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'package.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.build_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.checksum': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.install_scope': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.installed': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.license': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.size': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'package.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'process.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'process.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.command_line': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.elf.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.byte_order': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.cpu_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.creation_date': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.exports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.elf.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.abi_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.class': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.data': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.entrypoint': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.object_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.os_abi': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.header.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.elf.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.chi2': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.flags': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.physical_offset': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.virtual_address': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.segments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.elf.segments.sections': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.segments.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.elf.shared_libraries': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.elf.telfhash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.end': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.entry_leader.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.attested_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.attested_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.attested_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.command_line': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.entry_meta.source.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.entry_meta.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.interactive': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.session_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.session_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.session_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.session_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.parent.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.real_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.real_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.real_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.real_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.same_as_process': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.saved_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.saved_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.saved_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.saved_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.supplemental_groups.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.supplemental_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.tty': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.tty.char_device.major': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.tty.char_device.minor': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.entry_leader.working_directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.env_vars': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'process.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'process.exit_code': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.command_line': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.interactive': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.group_leader.real_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.real_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.real_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.real_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.same_as_process': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.saved_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.saved_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.saved_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.saved_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.supplemental_groups.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.supplemental_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.tty': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.tty.char_device.major': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.tty.char_device.minor': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.group_leader.working_directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.interactive': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.io': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.bytes_skipped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; type: string; }; 'process.io.bytes_skipped.length': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.bytes_skipped.offset': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.max_bytes_per_process_exceeded': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.text': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.total_bytes_captured': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.total_bytes_skipped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.io.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.macho.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.macho.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.macho.symhash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'process.parent.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'process.parent.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.command_line': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.byte_order': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.cpu_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.creation_date': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.exports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.abi_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.class': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.data': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.entrypoint': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.object_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.os_abi': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.header.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.chi2': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.flags': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.physical_offset': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.virtual_address': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.segments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.segments.sections': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.segments.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.shared_libraries': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.elf.telfhash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.end': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.exit_code': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.group_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.interactive': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.macho.symhash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.real_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.real_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.real_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.real_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.saved_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.saved_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.saved_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.saved_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.supplemental_groups.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.supplemental_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.thread.capabilities.effective': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'process.parent.thread.capabilities.permitted': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'process.parent.thread.id': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.thread.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.title': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.tty': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.tty.char_device.major': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.tty.char_device.minor': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.uptime': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.parent.working_directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.previous.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.previous.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.previous.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.real_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.real_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.real_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.real_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.saved_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.saved_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.saved_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.saved_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.session_leader.args': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.args_count': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.command_line': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.executable': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.interactive': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.session_leader.entity_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.session_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.session_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.session_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.parent.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.pid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.session_leader.real_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.real_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.real_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.real_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.same_as_process': { dashed_name: string; description: string; example: boolean; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.saved_group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.saved_group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.saved_user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.saved_user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.supplemental_groups.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.supplemental_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.tty': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.tty.char_device.major': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.tty.char_device.minor': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.session_leader.working_directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.start': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.supplemental_groups.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.supplemental_groups.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'process.thread.capabilities.effective': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'process.thread.capabilities.permitted': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; pattern: string; short: string; synthetic_source_keep: string; type: string; }; 'process.thread.id': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.thread.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.title': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.tty': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.tty.char_device.major': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.tty.char_device.minor': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.tty.columns': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.tty.rows': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'process.uptime': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; otel: { metric: string; relation: string; stability: string; }[]; short: string; type: string; }; 'process.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.vpid': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'process.working_directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'registry.data.bytes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'registry.data.strings': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; type: string; }; 'registry.data.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'registry.hive': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'registry.key': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'registry.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'registry.value': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'related.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'related.hosts': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'related.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; otel: { relation: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'related.user': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'rule.author': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'rule.category': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.license': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.ruleset': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.uuid': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'rule.version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.address': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'server.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; pattern: string; short: string; type: string; }; 'server.nat.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.nat.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.packets': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'server.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'server.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'server.user.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'service.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.environment': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'service.ephemeral_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'service.node.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { attribute: string; relation: string; stability: string; }[]; short: string; type: string; }; 'service.node.role': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.node.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'service.origin.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.origin.environment': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.ephemeral_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.node.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.node.role': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.node.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'service.origin.state': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.origin.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.state': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.target.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'service.target.environment': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.ephemeral_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.node.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.node.role': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.node.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'service.target.state': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.target.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'service.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'service.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'source.address': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'source.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.bytes': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.mac': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; pattern: string; short: string; type: string; }; 'source.nat.ip': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.nat.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.packets': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.port': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'source.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'source.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'source.user.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'span.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { otlp_field: string; relation: string; stability: string; }[]; short: string; type: string; }; tags: { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.enrichments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.enrichments.indicator': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.confidence': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.email.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.file.accessed': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.attributes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.created': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.ctime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.device': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.drive_letter': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.byte_order': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.cpu_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.creation_date': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.exports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.abi_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.class': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.data': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.entrypoint': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.object_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.os_abi': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.header.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.chi2': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.flags': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.physical_offset': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.virtual_address': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.segments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.segments.sections': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.segments.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.shared_libraries': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.elf.telfhash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.fork_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.gid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.group': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.inode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.mime_type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.mode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.mtime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.origin_referrer_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.origin_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.owner': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.target_path': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.uid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.file.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.first_seen': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.ip': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.last_seen': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.marking.tlp': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.marking.tlp_version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.modified_at': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.port': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.registry.data.bytes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.data.strings': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.data.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.hive': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.key': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.registry.value': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.scanner_stats': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.sightings': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.indicator.url.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.fragment': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.full': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.original': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.password': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.path': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.port': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.query': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.scheme': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.url.username': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.indicator.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.enrichments.matched.atomic': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.matched.field': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.matched.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.matched.index': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.matched.occurred': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.enrichments.matched.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.feed.dashboard_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.feed.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.feed.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.feed.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.framework': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.group.alias': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.group.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.group.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.group.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.as.number': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.as.organization.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.confidence': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.email.address': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.file.accessed': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.attributes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'threat.indicator.file.code_signature.digest_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.exists': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.flags': { beta: string; dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.signing_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.status': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.subject_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.team_id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.thumbprint_sha256': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; pattern: string; short: string; type: string; }; 'threat.indicator.file.code_signature.timestamp': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.trusted': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.code_signature.valid': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.created': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.ctime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.device': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.directory': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.drive_letter': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.byte_order': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.cpu_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.creation_date': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.exports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.abi_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.class': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.data': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.entrypoint': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.object_version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.os_abi': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.header.version': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.chi2': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.flags': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.physical_offset': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.virtual_address': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.segments': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.segments.sections': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.segments.type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.shared_libraries': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.elf.telfhash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.fork_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.gid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.group': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.cdhash': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.md5': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.sha1': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.sha256': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.sha384': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.sha512': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.ssdeep': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.hash.tlsh': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.inode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.mime_type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.mode': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.mtime': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.origin_referrer_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.origin_url': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.owner': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.architecture': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.company': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.file_version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.go_import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.go_imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.go_imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.go_imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.go_stripped': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.imphash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.import_hash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.imports': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.imports_names_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.imports_names_var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.original_file_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.pehash': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.product': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections.entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections.physical_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections.var_entropy': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.pe.sections.virtual_size': { dashed_name: string; description: string; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.target_path': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.uid': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.file.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.first_seen': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.geo.city_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.continent_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.continent_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.country_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.country_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.location': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.postal_code': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.region_iso_code': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.region_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.geo.timezone': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.indicator.ip': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.last_seen': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.marking.tlp': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.marking.tlp_version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.modified_at': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.port': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.provider': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.registry.data.bytes': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.data.strings': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.data.type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.hive': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.key': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.path': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.registry.value': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.scanner_stats': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.sightings': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.indicator.url.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.fragment': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.full': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.original': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.password': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.path': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.port': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.query': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.scheme': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.url.username': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'threat.indicator.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'threat.software.alias': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.software.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.software.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.software.platforms': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'threat.software.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.software.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'threat.tactic.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.tactic.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.tactic.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.subtechnique.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.subtechnique.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: string[]; short: string; type: string; }; 'threat.technique.subtechnique.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; type: string; }; 'tls.cipher': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.certificate': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.certificate_chain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.hash.md5': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.hash.sha1': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.hash.sha256': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.issuer': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.ja3': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.server_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'tls.client.subject': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.supported_ciphers': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.client.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.client.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.established': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.next_protocol': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.resumed': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.certificate': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.certificate_chain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.hash.md5': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.hash.sha1': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.hash.sha256': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.issuer': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.ja3s': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.subject': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'tls.server.x509.alternative_names': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.organizational_unit': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.issuer.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.not_after': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.not_before': { dashed_name: string; description: string; example: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.public_key_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.public_key_curve': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.public_key_exponent': { dashed_name: string; description: string; doc_values: boolean; example: number; flat_name: string; index: boolean; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.public_key_size': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.serial_number': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.signature_algorithm': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.common_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.country': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.distinguished_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.locality': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.organization': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.organizational_unit': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.subject.state_or_province': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'tls.server.x509.version_number': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'tls.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'tls.version_protocol': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'trace.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { otlp_field: string; relation: string; stability: string; }[]; short: string; type: string; }; 'transaction.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; }[]; short: string; type: string; }; 'url.domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.extension': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.fragment': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.full': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.original': { dashed_name: string; description: string; example: string; flat_name: string; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.password': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'url.path': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.port': { dashed_name: string; description: string; example: number; flat_name: string; format: string; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.query': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.registered_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.scheme': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.subdomain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.top_level_domain': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'url.username': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'user.changes.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.changes.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.changes.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'user.effective.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.effective.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.effective.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; otel: { relation: string; stability: string; }[]; short: string; synthetic_source_keep: string; type: string; }; 'user.target.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.known_redirects': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.managed': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.mfa_enabled': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.oauth_consent_restriction': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.permissions': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.attributes.storage_class': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.behavior': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.display_name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.last_seen_timestamp': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.lifecycle.last_activity': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.metrics': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.name': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.raw': { beta: string; dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.reference': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.administers.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.depends_on.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.owns.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.entity.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.host.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.host.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.service.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.service.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.user.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.user.email': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.user.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.relationships.supervises.user.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.source': { beta: string; dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.sub_type': { beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.entity.type': { allowed_values: { description: string; name: string; }[]; beta: string; dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; type: string; }; 'user.target.full_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.group.domain': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.group.id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.group.name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.hash': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.calculated_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.calculated_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.calculated_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.static_level': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.static_score': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.risk.static_score_norm': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user.target.roles': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; original_fieldset: string; short: string; synthetic_source_keep: string; type: string; }; 'user_agent.device.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'user_agent.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user_agent.original': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'user_agent.os.family': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.full': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.kernel': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.platform': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.type': { dashed_name: string; description: string; example: string; expected_values: string[]; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.os.version': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; original_fieldset: string; short: string; type: string; }; 'user_agent.version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; otel: { relation: string; stability: string; }[]; short: string; type: string; }; 'volume.bus_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.default_access': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.device_name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.device_type': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.dos_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.file_system_type': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.mount_name': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.nt_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.product_id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.product_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.removable': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.serial_number': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.size': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.vendor_id': { dashed_name: string; description: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.vendor_name': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'volume.writable': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.category': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: string[]; short: string; synthetic_source_keep: string; type: string; }; 'vulnerability.classification': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.description': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; multi_fields: { flat_name: string; name: string; type: string; }[]; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.enumeration': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.id': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.reference': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.report_id': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.scanner.vendor': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.score.base': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.score.environmental': { dashed_name: string; description: string; example: number; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.score.temporal': { dashed_name: string; description: string; flat_name: string; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.score.version': { dashed_name: string; description: string; example: number; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; 'vulnerability.severity': { dashed_name: string; description: string; example: string; flat_name: string; ignore_above: number; level: string; name: string; normalize: never[]; short: string; type: string; }; };