action
true
false
conndir
true
false
ifdir
true
false
ifname
true
false
loguid
true
false
origin
true
false
time
true
false
dst
true
false
dst_ip
true
false
destination_dns_hostname
true
false
observable_comment
true
false
description
true
false
product
true
false
proto
true
false
s_port
true
false
src_port
true
false
service
true
false
src
true
false
src_ip
true
false
src_user_dn
true
false
src_machine_name
true
false
src_user_name
true
false
user
true
false
user_agent
true
false
smartdefense_profile
true
false
blade_name
false
false