Field changes report

Latest versus Splunk_TA_aws 5.0.0

Summary

• Sourcetypes with changes: 18
• Total deleted fields: 18
• Total modified fields: 57
• Total new fields: 553

Detailed changes

aws:cloudfront:accesslogs

Field	Deleted	Modified	New	Is CIM
action	❌	❌	✅	✅
app	❌	❌	✅	✅
bytes	❌	❌	✅	✅
bytes_in	❌	❌	✅	✅
bytes_out	❌	❌	✅	✅
c_port	❌	❌	✅	❌
cached	❌	❌	✅	✅
category	❌	❌	✅	✅
cookie	❌	❌	✅	✅
cs_protocol_version	❌	❌	✅	❌
dest	❌	❌	✅	✅
duration	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
fle_encrypted_fields	❌	❌	✅	❌
fle_status	❌	❌	✅	❌
http_content_type	❌	❌	✅	✅
http_method	❌	❌	✅	✅
http_referrer	❌	❌	✅	✅
http_referrer_domain	❌	❌	✅	✅
http_user_agent	❌	❌	✅	✅
http_user_agent_length	❌	❌	✅	✅
response_time	❌	❌	✅	✅
sc_content_len	❌	❌	✅	❌
sc_content_type	❌	❌	✅	❌
sc_range_end	❌	❌	✅	❌
sc_range_start	❌	❌	✅	❌
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
src_port	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
time_to_first_byte	❌	❌	✅	❌
uri_path	❌	❌	✅	✅
uri_query	❌	❌	✅	✅
url	❌	❌	✅	✅
url_domain	❌	❌	✅	✅
url_length	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
x_edge_detail_result_type	❌	❌	✅	❌

aws:cloudtrail

Field	Deleted	Modified	New	Is CIM
action	❌	✅	✅	✅
app	✅	✅	❌	✅
authentication_method	❌	❌	✅	✅
change_type	❌	✅	✅	✅
command	❌	❌	✅	✅
dest	✅	✅	❌	✅
dest_ip_range	❌	❌	✅	✅
dest_port_range	❌	❌	✅	✅
direction	❌	❌	✅	✅
eventtype	✅	✅	✅	✅
image_id	❌	❌	✅	✅
instance_type	❌	❌	✅	✅
object	✅	✅	✅	✅
object_attrs	❌	❌	✅	✅
object_category	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_path	❌	❌	✅	✅
protocol	❌	❌	✅	✅
protocol_code	❌	❌	✅	❌
reason	❌	❌	✅	✅
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
rule_action	❌	❌	✅	✅
signature	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
src_ip_range	❌	❌	✅	✅
src_port_range	❌	❌	✅	✅
src_user	✅	✅	✅	✅
src_user_id	❌	❌	✅	✅
src_user_name	❌	❌	✅	✅
src_user_role	❌	❌	✅	✅
src_user_type	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	✅	✅	✅	✅
tag::eventtype	✅	✅	✅	❌
temp_access_key	❌	❌	✅	❌
user	✅	✅	✅	✅
user_access_key	❌	❌	✅	❌
user_agent	❌	❌	✅	✅
user_arn	❌	❌	✅	❌
user_id	❌	❌	✅	✅
user_name	❌	❌	✅	✅
user_role	❌	❌	✅	✅
user_type	✅	✅	❌	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

aws:cloudwatch

Field	Deleted	Modified	New	Is CIM
dest	❌	❌	✅	✅
mem_free	❌	❌	✅	✅
tag	❌	✅	❌	✅
tag::metric_name	❌	✅	❌	❌
vendor_product	❌	❌	✅	✅

aws:cloudwatch:guardduty

Field	Deleted	Modified	New	Is CIM
AWS__CloudTrail__Trail	❌	❌	✅	❌
AWS__IAM__Role	❌	❌	✅	❌
AWS__S3__Bucket	❌	❌	✅	❌
action	❌	❌	✅	✅
action_type	❌	❌	✅	❌
affectedResources	❌	❌	✅	❌
app	❌	❌	✅	✅
attacker_domain	❌	❌	✅	❌
aws_account_id	❌	❌	✅	❌
aws_az	❌	❌	✅	❌
aws_count	❌	❌	✅	❌
awsresource	❌	❌	✅	❌
body	❌	❌	✅	✅
category	❌	❌	✅	✅
ct_user	❌	❌	✅	❌
dest	❌	❌	✅	✅
dest_ip	❌	❌	✅	✅
dest_ip_internal	❌	❌	✅	❌
dest_name	❌	❌	✅	✅
dest_port	❌	❌	✅	✅
dest_type	❌	❌	✅	✅
dest_zone	❌	❌	✅	✅
detectorId	❌	❌	✅	❌
dvc	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
findingId	❌	❌	✅	❌
findingType	❌	❌	✅	❌
finding_category	❌	❌	✅	❌
gd_details	❌	❌	✅	❌
gd_object	❌	❌	✅	❌
ids_type	❌	❌	✅	✅
instanceId	❌	❌	✅	❌
lat	❌	❌	✅	❌
lon	❌	❌	✅	❌
outbound_attacker_domain	❌	❌	✅	❌
raw_gd_type	❌	❌	✅	❌
resource_type	❌	❌	✅	✅
severity	❌	✅	❌	✅
severity_id	❌	❌	✅	✅
signature	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
src	❌	❌	✅	✅
src_intrusion	❌	❌	✅	❌
src_ip	❌	❌	✅	✅
src_name	❌	❌	✅	❌
src_port	❌	❌	✅	✅
src_type	❌	❌	✅	✅
subject	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
transport	❌	❌	✅	✅
type	❌	✅	❌	✅
user	❌	❌	✅	✅
userName	❌	❌	✅	❌
user_name	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

aws:cloudwatchlogs:guardduty

Field	Deleted	Modified	New	Is CIM
accountId	❌	❌	✅	❌
action	❌	❌	✅	✅
action_type	❌	❌	✅	❌
app	❌	❌	✅	✅
body	❌	❌	✅	✅
category	❌	❌	✅	✅
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_name	❌	❌	✅	✅
dest_port	❌	❌	✅	✅
dest_type	❌	❌	✅	✅
dvc	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
findingType	❌	❌	✅	❌
finding_category	❌	❌	✅	❌
id	❌	✅	❌	✅
ids_type	❌	❌	✅	✅
instanceId	❌	❌	✅	❌
raw_gd_type	❌	❌	✅	❌
severity	❌	❌	✅	✅
severity_id	❌	❌	✅	✅
signature	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
src	❌	❌	✅	✅
src_name	❌	❌	✅	❌
src_port	❌	❌	✅	✅
src_type	❌	❌	✅	✅
subject	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
transport	❌	❌	✅	✅
type	❌	❌	✅	✅
user	❌	❌	✅	✅
user_name	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

aws:cloudwatchlogs:vpcflow

Field	Deleted	Modified	New	Is CIM
account_id	❌	✅	❌	❌
action	❌	✅	❌	✅
app	❌	❌	✅	✅
aws_account_id	❌	✅	❌	❌
az_id	❌	❌	✅	❌
bytes	❌	✅	❌	✅
dest	❌	✅	❌	✅
dest_ip	❌	✅	❌	✅
dest_port	❌	✅	❌	✅
duration	❌	❌	✅	✅
dvc	❌	❌	✅	✅
end_time	❌	✅	❌	❌
eventtype	✅	❌	❌	✅
flow_direction	❌	❌	✅	❌
instance_id	❌	❌	✅	❌
interface_id	❌	✅	❌	❌
log_status	❌	✅	❌	❌
packets	❌	✅	❌	✅
pkt_dst_aws_service	❌	❌	✅	❌
pkt_dstaddr	❌	❌	✅	❌
pkt_src_aws_service	❌	❌	✅	❌
pkt_srcaddr	❌	❌	✅	❌
protocol	❌	✅	❌	✅
protocol_code	❌	✅	❌	❌
protocol_full_name	❌	✅	❌	❌
protocol_version	❌	❌	✅	✅
region	✅	✅	❌	❌
src	❌	✅	❌	✅
src_ip	❌	✅	❌	✅
src_port	❌	✅	❌	✅
start_time	❌	✅	❌	✅
sublocation_id	❌	❌	✅	❌
sublocation_type	❌	❌	✅	❌
subnet_id	❌	❌	✅	❌
tag	✅	✅	❌	✅
tag::eventtype	✅	✅	❌	❌
tcp_flags	❌	❌	✅	❌
traffic_path	❌	❌	✅	❌
transport	❌	❌	✅	✅
type	❌	❌	✅	✅
user_id	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
version	❌	✅	❌	✅
vpc_id	❌	❌	✅	❌
vpcflow_action	❌	✅	❌	❌

aws:config

Field	Deleted	Modified	New	Is CIM
object_category	❌	✅	❌	✅
object_id	❌	✅	✅	✅
object_path	❌	❌	✅	✅
result	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:config:notification

Field	Deleted	Modified	New	Is CIM
object_attrs	❌	❌	✅	✅
object_category	❌	✅	❌	✅
object_id	❌	✅	❌	✅
object_path	❌	❌	✅	✅
result	❌	❌	✅	✅
user	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:config:rule

Field	Deleted	Modified	New	Is CIM
app	❌	❌	✅	✅
body	❌	❌	✅	✅
dest	❌	❌	✅	✅
severity	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
tag	✅	✅	❌	✅
tag::eventtype	✅	✅	❌	❌
type	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:description

Field	Deleted	Modified	New	Is CIM
cpu_cores	❌	❌	✅	✅
description	❌	❌	✅	✅
dns	❌	❌	✅	✅
enabled	❌	❌	✅	✅
eventtype	❌	✅	✅	✅
family	❌	❌	✅	✅
identity	❌	❌	✅	❌
image_name	❌	❌	✅	❌
mem_capacity	❌	❌	✅	❌
nt_host	❌	❌	✅	❌
snapshot	❌	❌	✅	✅
startDate	❌	❌	✅	❌
status	❌	❌	✅	✅
tag	❌	✅	❌	✅
tag::eventtype	❌	✅	❌	❌
time	❌	❌	✅	✅
type	❌	❌	✅	✅
user_id	❌	❌	✅	✅
user_name	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

aws:elb:accesslogs

Field	Deleted	Modified	New	Is CIM
ActionExecuted	❌	❌	✅	❌
ChosenCertArn	❌	❌	✅	❌
ClientPort	❌	❌	✅	❌
ClientSrcIP	❌	❌	✅	❌
ClientSrcPort	❌	❌	✅	❌
DomainName	❌	❌	✅	❌
ELB	❌	❌	✅	❌
ELBStatusCode	❌	❌	✅	❌
ErrorReason	❌	❌	✅	❌
MatchedRulePriority	❌	❌	✅	❌
ReceivedBytes	❌	❌	✅	❌
RedirectUrl	❌	❌	✅	❌
Request	❌	❌	✅	❌
RequestCreationTime	❌	❌	✅	❌
RequestProcessingTime	❌	❌	✅	❌
RequestTargetIP	❌	❌	✅	❌
RequestTargetPort	❌	❌	✅	❌
RequestType	❌	❌	✅	❌
ResponseProcessingTime	❌	❌	✅	❌
ResponseTime	❌	❌	✅	❌
SSLCipher	❌	❌	✅	❌
SSLProtocol	❌	❌	✅	❌
SentBytes	❌	❌	✅	❌
TargetGroupArn	❌	❌	✅	❌
TargetPort	❌	❌	✅	❌
TargetProcessingTime	❌	❌	✅	❌
TargetStatusCode	❌	❌	✅	❌
TraceId	❌	❌	✅	❌
UserAgent	❌	❌	✅	❌
action	❌	❌	✅	✅
app	❌	❌	✅	✅
bytes	❌	❌	✅	✅
bytes_in	❌	❌	✅	✅
bytes_out	❌	❌	✅	✅
category	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_port	❌	❌	✅	✅
elb_type	❌	❌	✅	❌
eventtype	❌	✅	❌	✅
http_method	❌	❌	✅	✅
http_user_agent	❌	❌	✅	✅
http_user_agent_length	❌	❌	✅	✅
response_time	❌	❌	✅	✅
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
src_port	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
url	❌	❌	✅	✅
url_length	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:inspector

Field	Deleted	Modified	New	Is CIM
body	❌	❌	✅	✅
dest	❌	❌	✅	✅
severity_id	❌	❌	✅	✅
tag	✅	✅	❌	✅
tag::eventtype	✅	✅	❌	❌
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:inspector:v2:findings

Field	Deleted	Modified	New	Is CIM
account_id	❌	❌	✅	❌
app	❌	❌	✅	✅
category	❌	❌	✅	✅
cve	❌	❌	✅	✅
cvss	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_type	❌	❌	✅	✅
dvc	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
id	❌	❌	✅	✅
inspector_dvc	❌	❌	✅	❌
region	❌	❌	✅	❌
severity	❌	✅	❌	✅
severity_id	❌	❌	✅	✅
signature	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
type	❌	✅	❌	✅
url	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

aws:metadata

Field	Deleted	Modified	New	Is CIM
AccountId	❌	✅	✅	❌
Region	❌	✅	✅	❌
account_id	❌	✅	✅	❌
availability_zone	❌	❌	✅	❌
aws_account_id	❌	❌	✅	❌
cpu_cores	❌	❌	✅	✅
custom_tag	❌	❌	✅	❌
dns	❌	❌	✅	✅
enabled	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
hypervisor_name	❌	❌	✅	❌
identity	❌	❌	✅	❌
image_id	❌	❌	✅	✅
ip	❌	❌	✅	✅
mem_capacity	❌	❌	✅	❌
nt_host	❌	❌	✅	❌
power_state	❌	❌	✅	❌
region	✅	✅	✅	❌
snapshot	❌	❌	✅	✅
startDate	❌	❌	✅	❌
status	❌	❌	✅	✅
storage_capacity	❌	❌	✅	❌
subnet_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
time	❌	❌	✅	✅
user_id	❌	❌	✅	✅
user_name	❌	❌	✅	✅
vendor	❌	❌	✅	❌
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅
virtual_network_id	❌	❌	✅	❌
virtual_subnet_id	❌	❌	✅	❌
vm_id	❌	❌	✅	❌
vm_os	❌	❌	✅	❌
vm_size	❌	❌	✅	❌
vpc_id	❌	❌	✅	❌

aws:s3

Field	Deleted	Modified	New	Is CIM
AuthType	❌	❌	✅	❌
BucketCreationTime	❌	❌	✅	❌
BucketName	❌	❌	✅	❌
BucketOwner	❌	❌	✅	❌
BytesSent	❌	❌	✅	❌
CipherSuite	❌	❌	✅	❌
ErrorCode	❌	❌	✅	❌
HTTPMethod	❌	❌	✅	❌
HTTPStatus	❌	❌	✅	❌
HostHeader	❌	❌	✅	❌
HostId	❌	❌	✅	❌
ObjectSize	❌	❌	✅	❌
OperationKey	❌	❌	✅	❌
Referer	❌	❌	✅	❌
RemoteIp	❌	❌	✅	❌
RequestID	❌	❌	✅	❌
RequestKey	❌	❌	✅	❌
RequestURI	❌	❌	✅	❌
RequestURIPath	❌	❌	✅	❌
Requester	❌	❌	✅	❌
SignatureVersion	❌	❌	✅	❌
TLSVersion	❌	❌	✅	❌
TotalTime	❌	❌	✅	❌
TurnAroundTime	❌	❌	✅	❌
UserAgent	❌	❌	✅	❌
VersionId	❌	❌	✅	❌
action	❌	❌	✅	✅
bytes	❌	❌	✅	✅
bytes_out	❌	❌	✅	✅
category	❌	❌	✅	✅
dest	❌	❌	✅	✅
error_code	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
http_method	❌	❌	✅	✅
http_referrer	❌	❌	✅	✅
http_referrer_domain	❌	❌	✅	✅
http_user_agent	❌	❌	✅	✅
http_user_agent_length	❌	❌	✅	✅
operation	❌	❌	✅	✅
response_time	❌	❌	✅	✅
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
status	❌	❌	✅	✅
storage_name	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
url	❌	❌	✅	✅
url_domain	❌	❌	✅	✅
url_length	❌	❌	✅	✅
user	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

aws:s3:accesslogs

Field	Deleted	Modified	New	Is CIM
access_point_arn	❌	❌	✅	❌
acl_required	❌	❌	✅	❌
action	❌	❌	✅	✅
app	❌	❌	✅	✅
authentication_type	❌	❌	✅	❌
bucket_name	❌	❌	✅	❌
bucket_owner	❌	❌	✅	❌
bytes	❌	❌	✅	✅
bytes_out	❌	❌	✅	✅
bytes_sent	❌	❌	✅	❌
category	❌	❌	✅	✅
cipher_suite	❌	❌	✅	❌
dest	❌	❌	✅	✅
duration	❌	❌	✅	✅
error_code	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
file_path	❌	❌	✅	✅
host_header	❌	❌	✅	❌
host_id	❌	❌	✅	❌
http_method	❌	❌	✅	✅
http_referrer	❌	❌	✅	✅
http_referrer_domain	❌	❌	✅	✅
http_status	❌	❌	✅	❌
http_user_agent	❌	❌	✅	✅
http_user_agent_length	❌	❌	✅	✅
key	❌	❌	✅	❌
object_size	❌	❌	✅	✅
operation	❌	❌	✅	✅
referrer	❌	❌	✅	❌
remote_ip	❌	❌	✅	❌
request_id	❌	❌	✅	❌
request_time	❌	❌	✅	❌
request_uri	❌	❌	✅	❌
requester	❌	❌	✅	❌
response_time	❌	❌	✅	✅
signature_version	❌	❌	✅	✅
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
status	❌	❌	✅	✅
storage_name	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
tls_version	❌	❌	✅	❌
total_time	❌	❌	✅	❌
turn_around_time	❌	❌	✅	❌
uri	❌	❌	✅	✅
uri_path	❌	❌	✅	✅
uri_protocol	❌	❌	✅	❌
uri_query	❌	❌	✅	✅
url	❌	❌	✅	✅
url_domain	❌	❌	✅	✅
url_length	❌	❌	✅	✅
user	❌	❌	✅	✅
user_agent	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
version_id	❌	❌	✅	❌

aws:securityhub:finding

Field	Deleted	Modified	New	Is CIM
accesskey_extract	❌	❌	✅	❌
account_user	❌	❌	✅	❌
app	❌	❌	✅	✅
body	❌	❌	✅	✅
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_ip	❌	❌	✅	✅
dest_name	❌	❌	✅	✅
dest_type	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
id	❌	❌	✅	✅
instance_extract	❌	❌	✅	❌
managed_instance_extract	❌	❌	✅	❌
recommendation	❌	❌	✅	❌
s3bucket_extract	❌	❌	✅	❌
security_group_extract	❌	❌	✅	❌
severity	❌	❌	✅	✅
severity_id	❌	❌	✅	✅
signature	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
subject	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
type	❌	❌	✅	✅
user	❌	❌	✅	✅
user_extract	❌	❌	✅	❌
user_name	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅
volume_extract	❌	❌	✅	❌
vpc_extract	❌	❌	✅	❌

aws:transitgateway:flowlogs

Field	Deleted	Modified	New	Is CIM
account_id	❌	❌	✅	❌
action	❌	❌	✅	✅
app	❌	❌	✅	✅
bytes	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_interface	❌	❌	✅	✅
dest_ip	❌	❌	✅	✅
dest_port	❌	❌	✅	✅
dest_zone	❌	❌	✅	✅
direction	❌	❌	✅	✅
dstaddr	❌	❌	✅	❌
dstport	❌	❌	✅	❌
duration	❌	❌	✅	✅
dvc	❌	❌	✅	✅
end	❌	❌	✅	❌
eventtype	❌	❌	✅	✅
flow_direction	❌	❌	✅	❌
log_status	❌	❌	✅	❌
packets	❌	❌	✅	✅
packets_lost_blackhole	❌	❌	✅	❌
packets_lost_mtu_exceeded	❌	❌	✅	❌
packets_lost_no_route	❌	❌	✅	❌
packets_lost_ttl_expired	❌	❌	✅	❌
pkt_dst_aws_service	❌	❌	✅	❌
pkt_src_aws_service	❌	❌	✅	❌
protocol	❌	❌	✅	✅
protocol_code	❌	❌	✅	❌
protocol_full_name	❌	❌	✅	❌
protocol_version	❌	❌	✅	✅
region	❌	❌	✅	❌
resource_type	❌	❌	✅	✅
src	❌	❌	✅	✅
src_interface	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
src_port	❌	❌	✅	✅
src_zone	❌	❌	✅	✅
srcaddr	❌	❌	✅	❌
srcport	❌	❌	✅	❌
start	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
tcp_flag	❌	❌	✅	✅
tcp_flags	❌	❌	✅	❌
tgw_attachment_id	❌	❌	✅	❌
tgw_dst_az_id	❌	❌	✅	❌
tgw_dst_eni	❌	❌	✅	❌
tgw_dst_subnet_id	❌	❌	✅	❌
tgw_dst_vpc_account_id	❌	❌	✅	❌
tgw_dst_vpc_id	❌	❌	✅	❌
tgw_id	❌	❌	✅	❌
tgw_pair_attachment_id	❌	❌	✅	❌
tgw_src_az_id	❌	❌	✅	❌
tgw_src_eni	❌	❌	✅	❌
tgw_src_subnet_id	❌	❌	✅	❌
tgw_src_vpc_account_id	❌	❌	✅	❌
tgw_src_vpc_id	❌	❌	✅	❌
transport	❌	❌	✅	✅
type	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
version	❌	❌	✅	✅