TYCHON Agentless
| Version | 1.1.1 (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Partner |
| Ingestion method(s) | File |
| Minimum Kibana version(s) | 9.0.0 8.14.0 |
TYCHON Agentless is an integration that lets you collect TYCHON's gold source Master Endpoint Record data from endpoints, including vulnerability and STIG results, without heavy resource use or software installation. You can then investigate the TYCHON data using Elastic's analytics, visualizations, and dashboards. Contact us to learn more..
- This integration supports Windows and RedHat/CENTOS Endpoint Operating Systems.
- This integration requires a TYCHON Agentless license.
- This integration requires TYCHON Vulnerability Definition files.
- The Linux Endpoint requires RedHat's OpenScap to be installed for STIG and CVE to report data.
TYCHON scans Endpoint ARP Tables and returns the results.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| input.type | Input Type. | keyword |
| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword |
| log.file.device_id | ID of the device containing the filesystem where the file resides. | keyword |
| log.file.fingerprint | The sha256 fingerprint identity of the file when fingerprinting is enabled. | keyword |
| log.file.idxhi | The high-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.idxlo | The low-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.inode | Inode number of the log file. | keyword |
| log.file.vol | The serial number of the volume that contains a file. (Windows-only) | keyword |
| log.offset | Log Offset. | long |
| tychon.destination.hostname | The Translated Hostname of the IP in the ARP Table | keyword |
| tychon.destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
| tychon.destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
| tychon.destination.name | keyword | |
| tychon.host.architecture | Operating system architecture. | keyword |
| tychon.host.biossn | Host BIOS Serial Number. | keyword |
| tychon.host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
| tychon.host.hardware.bios.name | Host BIOS Name. | keyword |
| tychon.host.hardware.bios.version | Host BIOS Version. | keyword |
| tychon.host.hardware.cpu.caption | Host CPU Caption. | keyword |
| tychon.host.hardware.manufacturer | Host BIOS Manufacturer. | keyword |
| tychon.host.hardware.owner | Host BIOS Owner. | keyword |
| tychon.host.hardware.serial_number | Host BIOS Serial Number. | keyword |
| tychon.host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. |
keyword |
| tychon.host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name. |
keyword |
| tychon.host.ip | Host ip addresses. | ip |
| tychon.host.ipv4 | Host IPv4 addresses. | ip |
| tychon.host.ipv6 | Host IPv6 addresses. | keyword |
| tychon.host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
| tychon.host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword |
| tychon.host.oem.manufacturer | Host OEM Manufacturer. | keyword |
| tychon.host.oem.model | Host OEM Model. | keyword |
| tychon.host.os.build | Host OS Build. | keyword |
| tychon.host.os.description | Host OS Description. | text |
| tychon.host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
| tychon.host.os.kernel | Operating system kernel version as a raw string. | keyword |
| tychon.host.os.name | Operating system name, without the version. | keyword |
| tychon.host.os.name.text | Multi-field of tychon.host.os.name. |
match_only_text |
| tychon.host.os.organization | Host OS Organization. | keyword |
| tychon.host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
| tychon.host.os.type | Use the os.type field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. |
keyword |
| tychon.host.os.version | Operating system version as a raw string. | keyword |
| tychon.host.type | Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. |
keyword |
| tychon.host.uptime | Seconds the host has been up. | long |
| tychon.host.workgroup | Host Workgroup Network Name. | keyword |
| tychon.id | TYCHON unique document identifier. | keyword |
| tychon.network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword |
| tychon.network.interface | The interface the ARP Table has associated the destination. | keyword |
| tychon.network.state | Current state | keyword |
| tychon.network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value is normalized to lowercase for querying. | keyword |
| tychon.script.current_duration | Scanner Script Duration. | long |
| tychon.script.current_time | Current datetime. | date |
| tychon.script.name | Scanner Script Name. | keyword |
| tychon.script.start | Scanner Start datetime. | date |
| tychon.script.type | Scanner Script Type. | keyword |
| tychon.script.version | Scanner Script Version. | version |
| tychon.tychon.data.version | Tychon data version | keyword |
| tychon.tychon.id | TYCHON unique host identifier. | keyword |
TYCHON checks local browser configuration settings.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| input.type | Input Type. | keyword |
| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword |
| log.file.device_id | ID of the device containing the filesystem where the file resides. | keyword |
| log.file.fingerprint | The sha256 fingerprint identity of the file when fingerprinting is enabled. | keyword |
| log.file.idxhi | The high-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.idxlo | The low-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.inode | Inode number of the log file. | keyword |
| log.file.vol | The serial number of the volume that contains a file. (Windows-only) | keyword |
| log.offset | Log Offset. | long |
| tychon.data.version | Tychon Data version. | keyword |
| tychon.destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
| tychon.destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
| tychon.edition | The product edition | keyword |
| tychon.event.reason | Event reason. | keyword |
| tychon.host.architecture | Operating system architecture. | keyword |
| tychon.host.biossn | Host BIOS Serial Number. | keyword |
| tychon.host.cloud.compute.location | The location of this cloud asset. | keyword |
| tychon.host.cloud.compute.name | The cloud based name of this asset | keyword |
| tychon.host.cloud.compute.resource_group_name | The resource group name given to this cloud asset | keyword |
| tychon.host.cloud.compute.resource_id | The cloud resource id assignd to this cloud asset. | keyword |
| tychon.host.cloud.compute.subscription_id | The subscription ID of the account for this cloud asset | keyword |
| tychon.host.cloud.compute.tags | Cloud compute tags assigned to this machine. | keyword |
| tychon.host.cloud.compute.vm_id | The Cloud ID of this cloud asset | keyword |
| tychon.host.cloud.hosted | Is this system cloud hosted | boolean |
| tychon.host.cloud.network.mac_address | Public facing MAC address of this cloud asset | keyword |
| tychon.host.cloud.network.public_ipv4 | Public facing IPV4 address for a cloud instance. | keyword |
| tychon.host.cloud.network.public_ipv6 | Public facing IPV6 address for a cloud instance. | keyword |
| tychon.host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
| tychon.host.hardware.bios.name | Host BIOS Name. | keyword |
| tychon.host.hardware.bios.version | Host BIOS Version. | keyword |
| tychon.host.hardware.cpu.caption | Host CPU Caption. | keyword |
| tychon.host.hardware.manufacturer | Host BIOS Manufacturer. | keyword |
| tychon.host.hardware.owner | Host BIOS Owner. | keyword |
| tychon.host.hardware.serial_number | Host BIOS Serial Number. | keyword |
| tychon.host.hostname | Hostname. | keyword |
| tychon.host.id | Host ID. | keyword |
| tychon.host.ip | Host IP addresses. | ip |
| tychon.host.ipv4 | Host IPv4 addresses. | ip |
| tychon.host.ipv6 | Host IPv6 addresses. | keyword |
| tychon.host.mac | Host mac addresses. | keyword |
| tychon.host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword |
| tychon.host.oem.manufacturer | Host OEM Manufacturer. | keyword |
| tychon.host.oem.model | Host OEM Model. | keyword |
| tychon.host.os.build | Host OS Build. | keyword |
| tychon.host.os.description | Host OS Description. | text |
| tychon.host.os.family | Host OS Family. | keyword |
| tychon.host.os.kernel | Operating system kernel version as a raw string. | keyword |
| tychon.host.os.name | Host OS Name. | keyword |
| tychon.host.os.organization | Host OS Organization. | keyword |
| tychon.host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
| tychon.host.os.type | Use the os.type field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. |
keyword |
| tychon.host.os.version | Host OS Version. | keyword |
| tychon.host.type | Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. |
keyword |
| tychon.host.uptime | Seconds the host has been up. | long |
| tychon.host.workgroup | Host Workgroup Network Name. | keyword |
| tychon.id | TYCHON unique document identifier. | keyword |
| tychon.package.architecture | Package architecture. | keyword |
| tychon.package.cpe | The cpe value for this application | keyword |
| tychon.package.edition | The edition of this application | keyword |
| tychon.package.installed | Time when package was installed. | date |
| tychon.package.name | Package name | keyword |
| tychon.package.path | Path where the package is installed. | keyword |
| tychon.package.publisher | The publisher of this application | keyword |
| tychon.package.size | Package size in bytes. | long |
| tychon.package.type | Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. | keyword |
| tychon.package.uninstall | Uninstall command to remove the package. | text |
| tychon.package.version | Package version | keyword |
| tychon.package.version_build | The build version of this application | keyword |
| tychon.package.version_major | The major version of this application | keyword |
| tychon.package.version_minor | The minor version of this application | keyword |
| tychon.package.version_release | The release version of this application | keyword |
| tychon.script.current_duration | Scanner Script Duration. | long |
| tychon.script.current_time | Current datetime. | date |
| tychon.script.name | Scanner Script Name. | keyword |
| tychon.script.start | Scanner Start datetime. | date |
| tychon.script.type | Scanner Script Type. | keyword |
| tychon.script.version | Scanner Script Version. | version |
| tychon.tls.version_protocol | Protocol name and version in the original format. | keyword |
| tychon.tychon.data.version | Data Version. | keyword |
| tychon.tychon.id | TYCHON unique host identifier. | keyword |
TYCHON connects to open ports on the computer and reports back if it is hosting ciphers and the certificate information from those ciphers.
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters |
constant_keyword |
| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword |
| input.type | Input Type. | keyword |
| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword |
| log.file.device_id | ID of the device containing the filesystem where the file resides. | keyword |
| log.file.fingerprint | The sha256 fingerprint identity of the file when fingerprinting is enabled. | keyword |
| log.file.idxhi | The high-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.idxlo | The low-order part of a unique identifier that is associated with a file. (Windows-only) | keyword |
| log.file.inode | Inode number of the log file. | keyword |
| log.file.vol | The serial number of the volume that contains a file. (Windows-only) | keyword |
| log.offset | Log Offset. | long |
| tychon.connection.state | The current state of the connection tested | keyword |
| tychon.file.accessed | Last time the file was accessed. Note that not all filesystems keep track of access time. | date |
| tychon.file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword |
| tychon.file.code_signature.friendly_name | The friendly name of the certificate or cipher | keyword |
| tychon.file.code_signature.issuer_name | The issuer of this certificate | keyword |
| tychon.file.code_signature.subject_name | The Subject Name of the signing certificate | keyword |
| tychon.file.code_signature.thumbprint | The unique ID thumbprint of this signing cert | keyword |
| tychon.file.created | File creation time. Note that not all filesystems store the creation time. | date |
| tychon.file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword |
| tychon.file.hash.md5 | MD5 hash. | keyword |
| tychon.file.hash.sha1 | SHA1 hash. | keyword |
| tychon.file.hash.sha256 | SHA256 hash. | keyword |
| tychon.file.mtime | Last time the file content was modified. | date |
| tychon.file.name | Name of the file including the extension, without the directory. | keyword |
| tychon.file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword |
| tychon.file.path.text | Multi-field of tychon.file.path. |
match_only_text |
| tychon.file.size | File size in bytes. Only relevant when file.type is "file". |
long |
| tychon.file.version | The version of the file | keyword |
| tychon.file.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword |
| tychon.host.architecture | Operating system architecture. | keyword |
| tychon.host.biossn | Host BIOS Serial Number. | keyword |
| tychon.host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
| tychon.host.hardware.bios.name | Host BIOS Name. | keyword |
| tychon.host.hardware.bios.version | Host BIOS Version. | keyword |
| tychon.host.hardware.cpu.caption | Host CPU Caption. | keyword |
| tychon.host.hardware.manufacturer | Host BIOS Manufacturer. | keyword |
| tychon.host.hardware.owner | Host BIOS Owner. | keyword |
| tychon.host.hardware.serial_number | Host BIOS Serial Number. | keyword |
| tychon.host.hostname | Hostname of the host. It normally contains what the hostname command returns on the host machine. |
keyword |
| tychon.host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of beat.name. |
keyword |
| tychon.host.ip | Host ip addresses. | ip |
| tychon.host.ipv4 | Host IPv4 addresses. | ip |
| tychon.host.ipv6 | Host IPv6 addresses. | keyword |
| tychon.host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword |
| tychon.host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword |
| tychon.host.oem.manufacturer | Host OEM Manufacturer. | keyword |
| tychon.host.oem.model | Host OEM Model. | keyword |
| tychon.host.os.build | Host OS Build. | keyword |
| tychon.host.os.description | Host OS Description. | text |
| tychon.host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
| tychon.host.os.kernel | Operating system kernel version as a raw string. | keyword |
| tychon.host.os.name | Operating system name, without the version. | keyword |
| tychon.host.os.name.text | Multi-field of tychon.host.os.name. |
match_only_text |
| tychon.host.os.organization | Host OS Organization. | keyword |
| tychon.host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
| tychon.host.os.type | Use the os.type field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. |
keyword |
| tychon.host.os.version | Operating system version as a raw string. | keyword |
| tychon.host.type | Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. |
keyword |
| tychon.host.uptime | Seconds the host has been up. | long |
| tychon.host.workgroup | Host Workgroup Network Name. | keyword |
| tychon.id | TYCHON unique document identifier. | keyword |
| tychon.process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard |
| tychon.process.command_line.text | Multi-field of tychon.process.command_line. |
match_only_text |
| tychon.process.description | The process description | keyword |
| tychon.process.executable | Absolute path to the process executable. | keyword |
| tychon.process.executable.text | Multi-field of tychon.process.executable. |
match_only_text |
| tychon.process.information_source | The process information source | keyword |
| tychon.process.name | Process name. Sometimes called program name or similar. | keyword |
| tychon.process.name.text | Multi-field of tychon.process.name. |
match_only_text |
| tychon.process.parent.pid | Process id. | long |
| tychon.process.pid | Process id. | long |
| tychon.process.user.name | Short name or login of the user. | keyword |
| tychon.process.user.name.text | Multi-field of tychon.process.user.name. |
match_only_text |
| tychon.script.current_duration | Scanner Script Duration. | long |
| tychon.script.current_time | Current datetime. | date |
| tychon.script.name | Scanner Script Name. | keyword |
| tychon.script.start | Scanner Start datetime. | date |
| tychon.script.type | Scanner Script Type. | keyword |
| tychon.script.version | Scanner Script Version. | version |
| tychon.server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the .address field. Then it should be duplicated to .ip or .domain, depending on which one it is. |
keyword |
| tychon.server.host | The host address of the site hosting the cipher. | keyword |
| tychon.server.ip | The IP of the site hosting the cipher. | ip |
| tychon.server.port | Port of the server. | long |
| tychon.service.description | The description of the service | keyword |
| tychon.service.display_name | The friendly name of the service | keyword |
| tychon.service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the service.name could contain the cluster name. For Beats the service.name is by default a copy of the service.type field if no name is specified. |
keyword |
| tychon.service.protocol.name | The protocol used by the listening service | keyword |
| tychon.service.state | Current state of the service. | keyword |
| tychon.tls.client.supported_ciphers | Array of ciphers offered by the client during the client hello. | keyword |
| tychon.tls.server.cipher.is_nist_approved | Cipher is NIST approved for Quantum resistance | boolean |
| tychon.tls.server.cipher.weight | The risk weight of the cipher | integer |
| tychon.tls.server.protocol.weight | The risk weight of the protocol | integer |
| tychon.tls.server.signature_hash.weight | The risk weight of the signature hash | integer |
| tychon.tls.server.supported_cipher_mac | Message Authentication Code Algorithms. | keyword |
| tychon.tls.server.supported_ciphers | Array of ciphers offered by the server during the client hello. | keyword |
| tychon.tls.server.supported_ciphers_mac | Array of cipher macs offered by the server during the client hello. | keyword |
| tychon.tychon.data.version | The Tychon data version | keyword |
| tychon.tychon.id | TYCHON unique host identifier. | keyword |
| tychon.url.full | If full URLs are important to your use case, they should be stored in url.full, whether this field is reconstructed or present in the event source. |
wildcard |
| tychon.url.full.text | Multi-field of tychon.url.full. |
match_only_text |
| tychon.x509.version_number | Version of x509 format. | keyword |