RSA NetWitness® Suite Unified Data Model Discontinued Concepts

Document created by RSA Link Team Employee on Feb 28, 2018Last modified by RSA Link Team Employee on Mar 26, 2018
Version 10Show Document
  • View in full screen mode

List of Discontinued Concepts 

 

The following table lists all the keys or concepts that have been discontinued. For backward compatibility of existing analytical content and analysts used to these keys, we will continue to use these keys. The discontinued keys will be removed from the default Content, Index-concentrator.xml and Table-map.xml files in future releases. RSA advises that you start using the new Meta keys going forward.

 

 

Discontinued Meta KeyReplaced by Meta key
ip.addralias.ip
ipv6.addralias.ipv6
ip.srcportport.src
ip.dstportport.dst
stransaddrip.trans.src
dtransaddrip.trans.dst
stransportport.trans.src
dtransportport.trans.dst
network.portport
ipv6.protoip.proto
privilegepermissions
usernameuser
orig_ipip.orig, ipv6.orig or host.orig based on usage
sdomaindomain.src
ddomaindomain.dst
ad.computer.srchost.src
ad.computer.dsthost.dst
ad.domain.srcdomain.src
ad.domain.dstdomain.dst
ad.username.srcuser.src
ad.username.dstuser.dst
ssl.cacert.ca
ssl.checksumchecksum
ssl.commoncert.common
ssl.subjectcert.subject
ssl.ver.srcversion
ssl.ver.dstversion
risk.warningNew Hunting Model (inv.*, ioc, boc, eoc, analysis.*)
risk.infoNew Hunting Model (inv.*, ioc, boc, eoc, analysis.*)
risk.suspiciousNew Hunting Model (inv.*, ioc, boc, eoc, analysis.*)
alert.idNew Hunting Model (inv.*, ioc, boc, eoc, analysis.*)
browseruser.agent
site.catcategory
event.classDiscontinued, no replacement
paddrDiscontinued, no replacement
process.timeduration.time
parent.pidprocess.id.src
child.pidprocess.id
eth.hostalias.mac

Attachments

    Outcomes